Key takeaways
- In the first hour, your job isn’t to clean the site. It’s to stop the damage spreading and keep the evidence intact.
- Work in this order: write down what you see, contain the site, take a snapshot, change passwords from a clean device, then call for help.
- Don’t delete files or restore an old backup in a panic. Both can destroy the clues needed to stop the attacker coming back.
- If customers’ personal or payment details might be involved, say so when you call for help. It changes what happens next.
If your WordPress site has been hacked, spend the first hour on containment, not clean-up. Note what you’re seeing and when. Then take the site offline or into maintenance mode if visitors are at risk, and snapshot everything before anything changes. Next, change your passwords from a device you trust, and call your host or a hacked-site specialist. The flowchart below shows the order.
Why does the first hour matter so much?
Because attackers work fast and at scale. Patchstack found that heavily exploited WordPress vulnerabilities were mass-exploited within a median of 5 hours of being disclosed (Patchstack). Wordfence blocked more than 55 billion password attacks in 2024 alone (Wordfence).
Once an attacker is in, each hour can bring more damage: spam pages indexed by Google, visitors sent to scam sites, your server blocked for email, or customer data copied. You can’t undo the break-in, but you can stop it getting worse.
Step 1: What should I write down first?
WordPress.org’s advice starts with two things: stay calm, then document (WordPress.org). Take five minutes to note:
- What you’re seeing, with screenshots and the web address.
- When you first noticed it, and who told you.
- Anything that changed recently, such as a new plugin, theme update or new user.
These notes become your incident report. Whoever cleans the site will ask for them, and they save real time.
Step 2: How do I contain a hacked WordPress site?
If visitors are being redirected, warned or asked for payment details, protect them first. Turn on maintenance mode, or ask your host to take the site offline. Don’t delete it.
- Online store? Pause payments until the checkout has been checked. Card-skimming code can sit quietly in a checkout page. Our guide to a WooCommerce hacked store explains what to look for.
- Visitors sent to scam sites? That’s usually a WordPress redirect hack, and it often hides from logged-in owners.
- Shared hosting? Tell your host. WordPress.org notes that a hack can affect more than one site on the same account.
Step 3: Why should I back up a hacked site?
It feels odd to back up something infected, but WordPress.org recommends it. Take “one more snapshot” before cleaning, so you have a copy to refer to if something goes badly wrong. Ask your host for the server’s access logs too. Together they show how the attacker got in.
The two most common mistakes we see are deleting suspicious files and restoring an old backup straight away. Both feel like progress. But they wipe the evidence, and if the way in is still open, the attacker simply returns.
Step 4: Which passwords should I change after a hack?
All of them, starting from a device you trust. WordPress.org warns that many attacks begin on the owner’s own computer, where malware captures logins. Run a full antivirus scan first, or use a different device.
- Your email account. Whoever controls it can reset every other password.
- Your hosting control panel and SFTP or FTP.
- The database password, updated in
wp-config.php. - Every WordPress administrator. Remove admin users you don’t recognise, and force a password reset for the rest.
- The WordPress security keys. Regenerating them logs everyone out, including the attacker.
Turn on two-factor login wherever you can. Then plan to change the passwords again once the site is clean, as WordPress.org also advises.
Step 5: Who should I call?
- Your host. They can isolate the site, share logs and check other sites on the server.
- A hacked-site specialist. Our hacked website repair team answers our 24/7 emergency line on 0426 833 422.
- The Australian Cyber Security Centre. Report cybercrime at cyber.gov.au/report or call 1300 CYBER1 (1300 292 371) (ASD).
If customer names, emails, addresses or payment details might have been exposed, say so straight away. You may have obligations under Australia’s Notifiable Data Breaches scheme, and the clock for assessing a suspected breach starts when you become aware of it.
When you call, have your notes ready, plus your hosting login details and a list of everyone with admin access. Mention what you’ve already changed, even small things. In our experience, a clear five-minute briefing at the start makes the whole clean-up faster and cheaper, because nobody has to guess what happened.
What shouldn’t I do in the first hour?
- Don’t delete files, plugins or the whole site.
- Don’t restore an old backup before the cause is known.
- Don’t install several security plugins at once. They can clash, and they can’t be trusted on a compromised site.
- Don’t contact the attacker or pay anyone who claims they can “unhack” your site.
- Don’t request a Google review yet. Asking before the site is clean can slow later reviews.
What happens after the first hour?
Then the real clean-up starts: find how the attacker got in, remove every file, user and backdoor they left, and harden the site. Our full recovery guide for when your website is hacked walks through it. Afterwards, secure web hosting and one of our website maintenance plans help make sure there isn’t a next time.
Frequently asked questions
Should I take my WordPress site offline after a hack?
If visitors are being redirected, shown warnings or asked for payment details, yes. Use maintenance mode or ask your host to block public access. Don’t delete the site or its files. You need them intact to find out how the attacker got in and to clean up properly.
Can I just restore yesterday’s backup?
Not straight away. The backup may already contain the infection, and restoring it doesn’t close the hole the attacker used. They can come back within hours. Take a snapshot of the hacked site first, find the cause, then decide whether a restore or a clean-up is the better path.
Do I have to tell my customers my website was hacked?
It depends on what was exposed and whether your business is covered by the Notifiable Data Breaches scheme. If personal information may have been accessed, you need to assess it quickly. Even when the law doesn’t require it, being honest with affected customers usually protects trust better than silence.
How did my WordPress site get hacked?
Most often through an outdated or vulnerable plugin or theme, or a weak or reused password. Patchstack found that 91% of new WordPress vulnerabilities in 2025 were in plugins. The snapshot and server logs you keep in the first hour are what let a specialist find the exact way in.
Is it safe to log in to my hacked WordPress site?
Use a device you trust, and change your passwords as you go. Avoid installing new plugins or editing files while you’re logged in, as that can overwrite evidence. If your password no longer works, don’t keep guessing. Reset it through your host or call for help.
Sources
- FAQ My site was hacked, WordPress.org, last updated 26 July 2026
- State of WordPress Security in 2026, Patchstack, accessed 13 November 2026
- 2024 Annual WordPress Security Report, Wordfence, April 2025
- Annual Cyber Threat Report 2024–25, Australian Signals Directorate, October 2025
- Security issues report, Google Search Console Help, accessed 13 November 2026