Write down the time and screenshot what you see before you touch anything. The next hour decides how much of this you do twice.
What to do in the first hour
This order comes from WordPress.org’s “FAQ My site was hacked”, the 24 April 2026 copy.
- Write down the date, the time and what you see, and screenshot it. Save a copy of the site as it is, infected and all, before anything is deleted.
- If you can still log in, reset every password now. If you are locked out, stop and call your host. The dashboard is not yours any more.
- Reset every way in, not just wp-admin: FTP or SFTP, your host’s control panel, the database. Then regenerate the secret keys in wp-config.php from https://api.wordpress.org/secret-key/1.1/salt/. That throws every session out, theirs included.
- Call your host and ask two things: is the account suspended, and are other sites on that server hit.
- Scan the computer you log in from. WordPress.org: “In many instances, the source of the attack / infection begins on your local box.”
None of that removes what they left behind. That is the section below, What a real cleanup involves.
How people find out their site was hacked
Nearly every way you find out is somebody else telling you. WordPress.org’s own list of signs includes being blocked by Google, the host disabling the site, and readers reporting virus warnings.
The rest are small wrong things: dashboard menu items gone, your role changed, the site in another language, a page you did not write.
Genny Davila’s dog accessories shop site was defaced. She asked CBS News Los Angeles: “Why would this happen to my website? I’m, like, a dog accessories company.”
If Google told you, there is also a warning to clear, further down.
Why changing the password does not fix it
A new password shuts the door they walked in through. It does nothing about the files they left behind, which let them back in without one. Those are backdoors.
Sucuri, which sells security products, found at least one hidden way back in on 49.21% of the sites its team cleaned. Those are the most recent figures available, from 2023.
Restore a backup taken after the break-in and you restore the break-in with it. The day you noticed is not the day it started.
A half cleanup costs you with Google. Its Safe Browsing repeat offenders policy (Google Search Central, updated December 2025) covers sites that flip between clean and infected in a short window. After that it is marked a repeat offender. You cannot ask for another review, and the mark stands 30 days.
What a real cleanup involves
Reinstall wp-admin and wp-includes by copying clean files over FTP. Do not use the dashboard reinstall button: an installer usually overwrites files already there, and a hack adds new ones (WordPress.org FAQ, 24 April 2026 copy).
Check .htaccess in every folder, not just the top one, then index.php, header.php, footer.php and functions.php. Search the database for content nobody wrote, and remove admin, FTP and database users you do not recognise.
Then the step people skip. Ask every company that flags sites to look again: Google, Bing, Norton, McAfee, Yandex. That list is Sucuri’s, from a cleanup guide with no date on it.
We do not clean hacked WordPress sites, and we cannot quote a price for work we do not do. Sucuri says get help if you are not comfortable editing PHP or database tables.
Why WordPress sites keep getting hacked
Every plugin is more software you did not write, running on a page anyone can find, at the same address on nearly every WordPress site. WordPress documentation concedes it: “every web application that exposes a login surface can be targeted” (Advanced Administration Handbook, Brute Force Attacks, February 2026).
Patchstack, which also sells security products, counted 11,334 new weaknesses in WordPress plugins, themes and core in 2025. 91% were in plugins. Six were in WordPress itself. Updating everything is not the whole answer. 46% had no fix on the day they went public. The weighted median time to a first attack is 5 hours. In paid plugins and themes, 76% were usable in real attacks (State of WordPress Security in 2026, data to 25 February 2026).
Plugins and themes do not update themselves by default (same handbook, Updating WordPress). The part that breaks sites is the part that sits still.
Ownership moves, too. EssentialPlugin ran more than 20 plugins, roughly 230,000 installs between them. It sold on the Flippa marketplace in 2025. Code that opened those sites shipped that September, dressed as a compatibility update. WordPress’s review team confirmed it in April 2026 (Patchstack, 15 April 2026). You cannot know who owns your plugin next year.
Updating fast does not ensure safety. With Smart Slider 3 Pro in April 2026 the bad file went out through the normal update channel, and the owners who got hit were the ones who updated quickly (Patchstack, 9 April 2026).
What a site with no login page can and cannot stop
We build on Astro and publish plain files on Cloudflare. No login page, no database, no plugins to update. There is no dashboard to guess a password for.
That covers the site, nothing else. Your email has a login. So do your Google Business Profile, your host account and your domain registrar account. Whoever gets your domain or DNS password can point your address anywhere, whatever the site is made of. Moving does not clean a site already infected, and it does not lift a Google warning. Someone else does that work, first.
We do not publish client sites, so this build is the one we can show you in full. We cannot promise you will never be hacked. Every change waits for your yes and goes in a log you can read.
If you want the rebuild, see what is included, then check the current complete pricing.