WordPress Website Hacked? How to Fix It and Make Sure It Never Happens Again

First, confirm what you are actually dealing with

The symptoms are familiar to anyone who has seen it: your homepage redirects to a gambling site, Google shows “This site may be harmed”, customers report a warning screen, or your host suspends the account for sending spam. Before touching anything, spend ten minutes identifying the type of compromise, because the recovery differs and guessing wastes the hours that matter most.

• Redirect hack: visitors from Google get sent elsewhere while a direct visit looks normal. Usually injected into theme files, .htaccess or the database.
• Pharma or SEO spam: your pages are fine to you but Google has indexed hundreds of unrelated pages. Check with a site search of your domain.
• Defacement: the homepage is replaced. Visible, alarming, and usually the easiest to clean.
• Backdoor and mailer: the site looks perfectly normal but is sending spam, which is why the host suspended it. The hardest to find and the most likely to recur.
• Malicious admin user: an unfamiliar administrator account exists in Users. Almost always accompanied by something else.

The recovery sequence that works

1. Take the site offline or into maintenance mode

Every hour a compromised site stays live is more spam indexed, more visitors at risk, and more damage to your domain reputation. A holding page is far better for your business than a site quietly serving malware to customers.

2. Change every credential, in the right order

Hosting panel first, then FTP and SFTP accounts, then the database user password, then all WordPress administrator accounts, then the registrar. Changing only the WordPress password is the most common mistake, because the attacker is usually holding a file-level backdoor and simply walks back in.

3. Scan and identify, do not guess

Compare your installation against clean copies. WordPress core files, plugin files and theme files should match the official versions exactly. Any file that differs, and any file in wp-content/uploads with a .php extension, deserves scrutiny. Uploads should contain images and documents, never executable code. Check the active theme’s functions.php, the root .htaccess, wp-config.php, and any recently modified file across the installation.

4. Clean the database as well as the files

File cleanup alone leaves half the infection in place. Check the wp_options table for injected scripts in unexpected rows, wp_users for accounts you did not create, wp_posts for injected links inside post content, and any scheduled task in wp_cron that reinstalls the payload. This step is skipped constantly, and it is why sites get reinfected within days.

5. Rebuild from clean sources

Replace WordPress core with a fresh download rather than repairing it. Reinstall every plugin and theme from official sources at their current versions. Delete anything you are not actively using: an inactive plugin is still executable code sitting on your server. If a plugin has been abandoned by its developer, this is the moment to replace it, not later.

6. Ask Google to review the site

Once the site is clean, open Google Search Console, look under Security Issues, and request a review. Also check the Removals and Coverage sections for spam pages the attacker created, and make sure they now return a proper error rather than a page. Reviews typically take a few days, and submitting while anything is still infected restarts the wait.

7. Watch it for two weeks

Reinfection usually appears within fourteen days if a backdoor was missed. Monitor file changes, check for new administrator accounts, and search your domain in Google periodically. A site that stays clean for a fortnight is genuinely clean.

How they got in, almost every time

In small business WordPress sites the cause is rarely sophisticated. It is one of five things.

An outdated plugin. A vulnerability is disclosed publicly, automated scanners sweep the entire internet within days, and any site still running the old version is found. This is the single most common cause by a wide margin.

A nulled theme or plugin. Paid software downloaded free from an unofficial site arrives with a backdoor deliberately included. It is not a risk, it is the business model. If your developer installed a premium theme without a licence, assume this.

A weak or reused administrator password. Combined with the default admin username, this needs no skill at all to break.

Shared hosting cross-contamination. On cheap shared plans, one infected site in a neighbouring account can reach yours through weak permissions. If you host multiple sites in one account, one compromise usually means all of them.

An old, forgotten installation. A staging copy at /old or /test that nobody has updated for three years, running an ancient WordPress version, quietly serving as the way in to everything else on the account.

The eight settings that prevent almost all of it

1. Automatic updates for core, plugins and themes. The lag between a disclosed vulnerability and an exploit is now days, and no manual schedule keeps up.
2. Delete what you do not use. Every inactive plugin and theme is executable code. Remove them rather than deactivating them.
3. Two-factor authentication on every administrator account. This alone neutralises password guessing entirely.
4. Rate-limit the login page. Lock out an IP after a handful of failed attempts. Brute force is automated and relentless, and this stops it cheaply.
5. Disable PHP execution in wp-content/uploads. A few lines of server configuration that turn most upload-based attacks into harmless files.
6. Disable the theme and plugin file editor by setting DISALLOW_FILE_EDIT in wp-config.php, so a stolen admin session cannot rewrite your site from the dashboard.
7. Off-site daily backups with a tested restore. A backup stored on the same server is not a backup, and one you have never restored is a hope, not a plan.
8. Security headers and a firewall at the server or CDN layer, plus uptime and file-change monitoring so you find out before your customers do.

What a hack actually costs a Pune business

The cleanup fee is the smallest part. A site flagged by Google can lose most of its organic traffic within days, and recovering rankings takes weeks after the warning is lifted. Customers who saw a warning screen remember it. If your domain starts sending spam, your business email deliverability suffers, which means quotations landing in junk folders for months afterwards. For an e-commerce site, every hour offline is direct revenue lost.

Set against that, a maintenance plan at Rs. 500 to Rs. 2,000 a month covering updates, backups, monitoring and hardening is not an expense to be optimised away. It is the cheapest insurance in your entire technology budget, and the businesses that skip it are the ones reading this article at 2 a.m.

When to rebuild instead of clean

Sometimes recovery is the wrong call. Rebuild if the site has been compromised more than twice, if it runs a nulled theme you cannot legitimately replace, if it depends on abandoned plugins with no maintained alternative, if it runs on a PHP version no longer receiving security updates, or if nobody can tell you what half the installed plugins actually do. In those situations cleaning buys a few weeks and the same call happens again. A clean rebuild on a current stack, from Rs. 7,999 for a standard business site, usually costs less than two rounds of emergency cleanup and leaves you with something maintainable.

If your site is compromised right now

Back it up as it is, take it into maintenance mode, change hosting and registrar passwords from a different device, and get help before deleting anything. Codelith Lab handles emergency WordPress recovery for businesses in Pune, including database cleanup, Search Console review submission and post-recovery hardening, and we will tell you honestly whether cleaning or rebuilding is the better use of your money. Message us on WhatsApp with your domain and what you are seeing, and we will confirm the type of compromise before you spend anything.

Frequently Asked Questions

How do I know if my WordPress site is hacked?

Common signs are visitors from Google being redirected elsewhere, a browser warning screen, unfamiliar administrator accounts in the Users list, unexpected pages appearing when you search your domain in Google, a sudden traffic collapse, or your host suspending the account for outbound spam. Files in wp-content/uploads with a .php extension are another reliable indicator.

How long does it take to clean a hacked WordPress site?

A straightforward infection typically takes four to eight hours to clean properly, covering files, database, credentials and hardening. Complex or repeated compromises take longer, and Google’s security review adds a few days after submission. Rushing the database step is the main reason sites become reinfected within a fortnight.

Will I lose my content and rankings?

Content is usually recoverable, which is why the first step is backing up the site as it is before changing anything. Rankings can drop sharply while a security warning is live, but they generally recover over several weeks once the site is clean and Google’s review clears it. The longer a compromise stays live, the longer that recovery takes.

How do hackers get into a WordPress site?

Most commonly through an outdated plugin with a publicly disclosed vulnerability, a nulled premium theme or plugin containing a deliberate backdoor, a weak administrator password, cross-contamination on cheap shared hosting, or a forgotten old installation in a subfolder running an ancient version. Targeted attacks on small business sites are rare by comparison.

Should I clean the site or rebuild it?

Rebuild if the site has been compromised more than twice, runs a nulled theme, depends on abandoned plugins, or sits on an unsupported PHP version. In those cases cleaning buys a few weeks before the same thing happens again. A clean rebuild on a current stack, from Rs. 7,999 for a standard business site, often costs less than two emergency cleanups.