I think my site was hacked. What do I do?

What do I do in the first hour?

1. Document what you see. Screenshots that include the address bar and any warnings. Note the time and your time zone.
2. Note anything that changed recently. A new plugin, a theme change, a new login, an unusual email.
3. Contact your web company or host with the screenshots and notes. They can check server logs and backups.
4. Scan your own computer. WordPress notes that attacks often start with a login stolen from an infected computer. Run a full antivirus scan before you log in from it again.
5. Change passwords from a trusted device, email first. Whoever controls your email can reset every other password, so secure it first: new password, sign out other sessions, check forwarding rules and recovery details, and turn on two-factor login. Then change the website admin, hosting and domain company passwords. Use long, unique passwords from a password manager.
6. Turn on two-factor login for each of those. See turn on two-factor login.

Expected result: the people fixing it have what they need, and the attacker’s stolen passwords no longer work.

The short version

• Don’t delete files or restore a backup yourself. Screenshot odd pages and note the time.
• Call your host or web company (E-3 sites: 814-399-4655), then change passwords from a computer you trust.

How can I tell if it was hacked?

Common signs:

• spam links or whole pages you didn’t create, often for drugs, fake goods or gambling;
• visitors, especially on phones, being sent to a different website;
• odd titles or foreign text under your business name in Google;
• a red browser warning such as “Deceptive site ahead”;
• WordPress admin users you don’t recognize;
• your host suspending the site or emailing about malware;
• customers saying your site sent them spam or asked for payment details.

WordPress lists similar signs in its guide, FAQ: My site was hacked.

Why does it matter?

A hacked site can send your customers to scam pages, steal form entries, or get your site and email flagged by Google and spam filters. Acting in the right order protects visitors and keeps the evidence needed to close the way in.

What does a proper cleanup involve?

This is work for your web company or host, but it helps to know what to expect:

1. Take a full copy of the site as it is, infected, to keep the evidence. If the site is harming visitors, put it in maintenance mode.
2. Look for how they got in: unknown admin users, changed WordPress core files, plugins or files nobody installed.
3. Restore a clean backup from before the attack, when one exists. See is my website backed up?
4. Reset every password and key: WordPress users, hosting, database and file access, plus the security keys that log everyone out.
5. Update WordPress, the theme and every plugin, and remove ones you don’t use.
6. Ask Google to review the site if it was flagged.

Common ways in are an out-of-date plugin or theme, and a stolen or weak password.

How do I get a Google warning removed?

If your site is in Google Search Console:

1. Sign in and choose your site.
2. Open the Security issues report. Google’s Security Issues help explains each issue.
3. Fix every issue on every page.
4. Select Request Review, and explain what the problem was, what you did, and the result.
5. Wait for Google’s answer. Google says reviews can take from several days to several weeks.

What are the common mistakes and edge cases?

• Paying someone who claims they hacked you, or who emails offering to fix it for a fee. Never pay them.
• Using WordPress’s built-in reinstall. WordPress warns it only overwrites existing files, while hacks usually add new ones.
• Restoring a backup without closing the hole. If you don’t know how they got in, they can get in again.
• Logging in from a computer you suspect, which can hand over the new password too.
• Customer data exposed. If form entries or orders may have leaked, you may have a duty to tell people. This isn’t legal advice: talk to a lawyer or your insurer.
• Spam sent from your domain. Your business email may land in spam for a while. See why good emails land in junk.

What if this didn’t work?

• The hack came back: the way in wasn’t closed. A hidden admin user, a leftover file or a reused password are common causes.
• Google still shows a warning: check every issue in the report is fixed, then request a review.
• Your host suspended the site: ask exactly what they found and what they need to see before turning it back on.
• You can’t log in: see log in or reset a forgotten password.

How does E-3 handle this?

Sites E-3 looks after have uptime monitoring, tested updates, daily backups and security alerts. When a site is hacked, people at E-3 do the cleanup.

If you think your site has been hacked, call 814-399-4655 straight away. Have ready the address of each odd page, your screenshots, the time you noticed, and any emails from your host, Google or customers. Please don’t change plugins or delete anything on a site we maintain. You can also email support@e3help.me, but call first if visitors are being sent somewhere they shouldn’t go.

Related questions

• Is my website backed up, and can you restore it?
• Do you keep my WordPress site and plugins updated?
• How to share access safely
• WordPress security for small businesses