Discovering that your website has been hacked can be alarming, particularly if your business relies on it for enquiries, sales or communication with customers.
Perhaps your website has suddenly started redirecting visitors somewhere else. Maybe strange pages have appeared in Google, your hosting provider has reported malware, or you’ve discovered an administrator account you don’t recognise.
Whatever the symptoms, the important thing is to act quickly and methodically.
WordPress is an extremely flexible platform, but like any software connected to the internet, it needs to be maintained and secured properly.
In this guide, we’ll look at some of the signs that a WordPress website may have been compromised, what you should do if it happens, and importantly, what you can put in place to reduce the chances of it happening again.
How do you know if your WordPress website has been hacked?
Not every website problem means that your site has been compromised.
A broken plugin, failed update or hosting problem can sometimes produce symptoms that initially look much more serious.
However, there are several warning signs worth investigating.
These can include:
- Your website redirecting visitors to another website
- Pages or posts appearing that you didn’t create
- New WordPress administrator accounts
- Security warnings appearing in browsers
- Google reporting security problems with your website
- Unexpected changes to website files
- Spam appearing within your pages or search results
- Your hosting provider reporting malware
- Customers reporting unusual behaviour
- Your website suddenly becoming extremely slow
- Emails being sent from your website without your knowledge
- Being unable to log into WordPress
Google Search Console can also be extremely useful here. If Google detects certain security problems while crawling your website, it may notify you through Search Console.
If something doesn’t look right, don’t ignore it.
Step 1: Don’t immediately delete everything
The first reaction to a compromised website is often to start deleting suspicious files.
That isn’t always the best approach.
Before making significant changes, try to establish what has happened.
Make a note of:
- when you first noticed the problem
- what unusual behaviour you’ve seen
- any recent WordPress, theme or plugin changes
- whether new users have appeared
- whether your hosting provider has sent any warnings
- any suspicious files or directories you’ve identified
If you have access to server or security logs, preserve those too.
Understanding how the website was compromised is important. Simply removing one malicious file doesn’t necessarily remove the vulnerability that allowed it to appear.
Step 2: Take a backup of the compromised website
This might sound strange.
Why would you want to back up a hacked website?
Because the compromised version can still be useful when investigating what happened, and if something goes wrong during the clean-up process you have a snapshot of the website as it existed before you started making changes.
Ideally, this shouldn’t replace your existing clean backups.
A good backup strategy should give you multiple restore points so that you can potentially return the website to a version from before the compromise occurred.
This is one of the reasons we consider automated website backups an essential part of managing a business website rather than an optional extra.
Step 3: Change your passwords and secure access
If an attacker has obtained login credentials, cleaning the website without changing those credentials could simply allow them straight back in.
You should review all of the ways somebody can access the website.
That may include:
- WordPress administrator accounts
- Hosting control panel
- SFTP or SSH accounts
- Database credentials
- Email accounts associated with WordPress administrators
- Cloud or server management accounts
Use strong, unique passwords rather than variations of passwords you use elsewhere.
Where possible, enable two-factor authentication as an additional layer of protection.
You should also review the WordPress Users section carefully and remove any administrator accounts that shouldn’t be there.
WordPress authentication keys and salts can also be regenerated to invalidate existing login sessions.
Step 4: Work out how the website was compromised
This is one of the most important steps.
Removing the malware is only half of the job.
You also need to understand how it got there.
With WordPress websites, potential routes can include:
- vulnerable or outdated plugins
- outdated WordPress installations
- vulnerable themes
- abandoned plugins that are no longer maintained
- compromised administrator credentials
- weak passwords
- malicious or pirated plugins and themes
- compromised hosting or server accounts
- insecure custom code
- compromised developer or administrator computers
WordPress itself is actively maintained and receives regular security updates.
The bigger challenge is that a typical WordPress website may also contain a theme and numerous third-party plugins, each of which adds additional code that needs to be maintained.
That makes plugin and update management particularly important.
Step 5: Scan and clean the website
The website now needs to be checked for malicious or modified files.
This can involve comparing WordPress core files against clean versions, checking themes and plugins, examining recently modified files and looking for suspicious PHP or JavaScript.
Particular attention should be paid to unexpected files inside areas such as:
wp-content/uploads/
wp-content/plugins/
wp-content/themes/
and the root WordPress directory.
Core WordPress files can often be replaced with clean copies from the official WordPress distribution.
Plugins and themes may also need to be replaced with clean versions from their original, trusted sources.
However, be careful.
A sophisticated compromise may involve multiple files, database changes, administrator accounts or persistent backdoors.
Deleting the first suspicious file you find does not necessarily mean the website is clean.
If you’re uncomfortable inspecting WordPress files, databases and server logs, this is the point where getting help from an experienced WordPress developer can be worthwhile.
Learn more about our WordPress development services
Step 6: Update WordPress, plugins and themes
Once the website has been cleaned, everything should be reviewed and brought up to date.
That includes:
- WordPress core
- plugins
- themes
- server software where applicable
Plugins that are no longer required should be removed rather than simply deactivated.
It’s also worth checking whether the plugins you’re using are still actively maintained.
If a plugin hasn’t received updates for a significant period of time, investigate whether it is still suitable for a business website.
Updates aren’t just about adding new features.
They frequently contain bug fixes and security patches.
Leaving WordPress plugins several versions behind can therefore expose your website to vulnerabilities that have already been discovered and fixed by the developer.
Step 7: Change your passwords again
Yes, again.
If you changed passwords while the website was still compromised, there is a possibility that malicious code could have captured the new credentials.
Once you’re confident the website is clean, change important passwords again.
This helps ensure you’re starting from a known, secure position.
Step 8: Check Google and Search Console
A compromised website can sometimes have consequences beyond the website itself.
Attackers may create hundreds or even thousands of spam pages designed to appear in search engines.
Common examples include pharmaceutical spam, gambling pages, fake product listings and pages linking to unrelated websites.
Even after the malicious content has been removed, some of those URLs may remain visible in Google’s index temporarily.
Check Google Search Console for:
- security issues
- unusual indexed pages
- unexpected URLs
- crawl problems
- manual actions
You can then work through any remaining search-related problems once the website itself has been secured.
How do you prevent your WordPress website from being hacked again?
Cleaning a hacked website gets you back online.
The more important question is what happens afterwards.
Website security isn’t one setting or one security plugin. It’s a combination of sensible measures that reduce risk and make it easier to recover when something does go wrong.
For a business website, we’d focus on four particularly important areas.
1. Keep WordPress and plugins updated
Running outdated software unnecessarily increases your exposure to known vulnerabilities.
Updates should therefore be treated as ongoing website maintenance.
At Lucidflare Tech, we can manage WordPress core, theme and plugin updates for the websites we maintain.
Importantly, this isn’t simply about clicking “Update All”.
Updates can occasionally introduce compatibility problems, so they need to be managed alongside backups and website monitoring.
2. Have proper automated backups
Backups are your safety net.
If a website suffers a serious problem, having a known good backup can turn a potential disaster into a manageable recovery job.
But simply having “a backup” isn’t enough.
Ideally you want:
- automatic scheduled backups
- multiple restore points
- website files and database backups
- backups stored separately from the live website
- a clear process for restoring them
If your only backup sits on the same server as your website, a serious server or account compromise could potentially affect both.
Our managed hosting includes regular automated backups so that there are restore points available when they’re needed.
3. Monitor your website
A compromised website isn’t always immediately obvious.
Some attacks deliberately try to remain hidden.
Others only show malicious content to particular visitors, devices or search engines.
That’s why monitoring matters.
At Lucidflare Tech, our managed hosting and support services include proactive monitoring of the websites and infrastructure we manage.
The sooner an unexpected problem is identified, the sooner it can be investigated.
4. Choose suitable WordPress hosting
Hosting is part of your website’s security.
Your WordPress installation sits on top of a web server, database, PHP environment, operating system and network infrastructure.
Those layers need maintaining too.
Our managed web hosting is designed for businesses that don’t want to worry about managing that infrastructure themselves.
We take care of areas including:
- hosting infrastructure
- SSL certificates
- security configuration
- automated backups
- monitoring
- software updates
- security patching
- performance optimisation
- ongoing technical support
Learn more about our managed web hosting
Can WordPress websites be secure?
Absolutely.
The fact that WordPress websites can be compromised doesn’t make WordPress inherently insecure.
Any widely used website platform is a target for automated attacks.
The important difference is how the website is developed, hosted and maintained.
A professionally managed WordPress website with good hosting, sensible access controls, regular updates, security monitoring and reliable backups is in a very different position from a website that hasn’t been updated for three years and contains dozens of abandoned plugins.
Security is ultimately about reducing risk rather than pretending that risk can be eliminated completely.
Has your WordPress website been hacked?
If you’ve discovered suspicious behaviour on your WordPress website and aren’t sure what to do next, we can help investigate the problem and determine the best route forward.
At Lucidflare Tech, we provide professional WordPress development and managed hosting for businesses across Newcastle, Gateshead, the North East and the wider UK.
We can help with existing WordPress websites as well as providing ongoing hosting and maintenance designed to reduce the chances of problems occurring in the first place.
Our services include:
- WordPress development and technical support
- Managed WordPress hosting
- Security and uptime monitoring
- Automated website backups
- WordPress core updates
- Plugin and theme update management
- Website migrations
- Performance optimisation
- Ongoing technical maintenance
If you’d rather concentrate on running your business than worrying about WordPress updates, backups and server security, that’s exactly the kind of technical work we can take care of.
Explore our WordPress development services
Or get in touch with us to discuss your website.
