Your WordPress website was hacked: what to do, step by step

What you'll achieve

• stop the damage without losing the evidence;
• bring the website back to a clean state, from a backup or by reinstalling;
• change everything that could have been stolen: passwords, keys, users;
• request removal of the Google warning, if one appeared.

Before you start

• Write to us from the start. Restoring from a backup from the last 7 days is free, and we also have the copy on separate storage. Tell us the domain and when you noticed the problem.
• Write down what you see: the address of the strange page, where the website sends you, the Google message, the time. Take screenshots.
• Work from a clean computer, with the system and browser up to date. If the password was stolen from your computer, changing it from the same computer is pointless.
• We use the English names from the Enhance interface, exactly as they appear on screen. If the panel opens in another language, switch it to English from the top right: “My account” » “Language”.

The steps

A. Stop the damage and keep a copy

1. In Enhance, open “Websites”, then the website, the “Apps” tab and the website's WordPress page. Under “General”, turn on “Maintenance mode”: visitors see a maintenance page instead of the infected website.
2. Take a backup of the current state, even though it's infected: the “Backups” tab » “Create backup” (with the language set to “English (US)”, “Backup now”), with the note “infected, before cleanup”. It helps us find out how the attacker got in.
3. Change your Enhance password right away (see Enhance password and two-factor authentication). If the attacker has access to the panel, any cleanup is pointless.

B. Find out when it was hacked

4. In the “Files” tab, look for recently modified files in places where you haven't worked: .htaccess, index.php, wp-config.php and the wp-content folder. You can see the modification date with right-click » “Get info”.
5. In WordPress, under Users, look for administrators you didn't create. Don't delete them yet: write down their names and dates.
6. Pick the day before the first sign. That's the “clean” backup you restore from.

C. Bring the website back to a clean state

7. If the problem is less than 7 days old, restore the website from the clean day's backup: the “Backups” tab, on the chosen backup, “Restore” » “Full website” (the steps are in Backup and restore from Enhance). Anything you changed on the website after the backup's time is lost, so write down new orders or posts beforehand.

8. If it's older, or you don't know how old it is, there's no backup you can be sure is clean. The cleanup is done piece by piece:

   • the WordPress core: in WordPress, Dashboard » Updates, the button that reinstalls the current version (Re-install version …). It replaces the WordPress files without touching your content;
   • plugins and themes: delete all the ones you don't use, and reinstall the others from the official source (WordPress.org or the developer's website), not from a copy of your own;
   • the wp-content/uploads folder: this is where images live, not code. Any .php file found there is suspicious;
   • wp-config.php and .htaccess: compare them with what you know they should contain and remove the lines you don't recognize.

   This part requires care. If you're not sure what is good code and what isn't, write to us before deleting anything.

D. Close the door

9. Update everything: WordPress, the plugins, the theme (see WordPress updates and security in Enhance). Most often, the attacker gets in through an old plugin with a known vulnerability.
10. Delete the unknown users found in step 5. When you delete them, WordPress asks who to attribute their content to; choose yourself.
11. Change all passwords, not just the WordPress one (the full list is in Strong passwords and two-factor authentication, everywhere):
    • all WordPress administrators;
    • the database user, in the “Databases” tab in Enhance. Then put the same new password in wp-config.php, under DB_PASSWORD, otherwise the website shows “Error establishing a database connection”;
    • the FTP accounts and the domain's email addresses.
12. Change the WordPress security keys. In wp-config.php there are eight lines starting with define( 'AUTH_KEY', SECURE_AUTH_KEY and so on. Replace them with a new set, generated by WordPress at https://api.wordpress.org/secret-key/1.1/salt/. All logged-in users are logged out, including the attacker.
13. Turn off “Maintenance mode” and check the website from a private window, on your computer and on your phone. Some infections only show on phones, or only when you arrive from Google.

E. Remove the Google warning

14. If Google has flagged the website as dangerous, go to Search Console, under Security & Manual Actions » Security issues. You'll see exactly what Google found (see Google Search Console: connect your website to Google).
15. After the cleanup, click Request review there and briefly describe what you did. The review can take a few days.

So it doesn't happen again

• Keep WordPress, the plugins and the theme up to date, with automatic updates turned on (see WordPress updates and security in Enhance).
• Only use plugins from official sources. “Premium” plugins and themes downloaded for free from other websites often come with hidden code (see The plugins a WordPress website needs).
• A separate account for each person who works on the website, with the minimum role they need (see WordPress users: roles, access and cleanup).
• Two-factor authentication on Enhance and on WordPress.
• Correct file permissions and no PHP in uploads (see File permissions: 644, 755 and what you never set).

If something doesn't work

• After restoring, the infection comes back within hours or days. The door was left open: an old plugin, a password that wasn't changed, or an unknown user that was left behind. Go through section D again. If it happens again, write to us.
• You can't log in to WordPress. The attacker changed the password. In Enhance, on the WordPress page, under “WordPress users”, use “Change password” on your account.
• The website sends spam by email. The limit of 200 messages per hour is reached quickly and the messages are stopped. Write to us: we'll check where they come from and clear the sending queue.
• Google still shows foreign pages in the results after the cleanup. Old results disappear gradually. Pages that now return 404 can be removed faster from Search Console, with Removals.