In what order should you fix a hacked WordPress site?
If your WordPress site has been hacked, work in this order: confirm the hack, contain it, take a copy, find the way in, clean the files and the database, close the hole, then ask Google to review the site. Skipping steps, especially the copy and the entry point, is how sites get reinfected a week later.
This guide is vendor-neutral. It will not tell you to buy a particular scanner. Some steps need access to your hosting account and basic comfort with files and databases; where that is beyond you, the last section explains when to hand it over.
The first hour: signs and containment
How hacks usually show up
- Visitors on phones are redirected to gambling, slot or pharmacy pages, while you see the normal site on your desktop.
- Searching site:yourdomain.com on Google shows pages you never made, often Thai-language casino or slot spam.
- Google Search Console reports a problem under Security issues, or Chrome shows a red warning page.
- Your host suspends the account for malware or for sending spam email.
- An Administrator account you do not recognise appears under Users.
Once you are fairly sure, do the containment steps below before anything else. They limit what the attacker can still do while you work.
- Put the site in maintenance modeOr ask your host to block public access, so visitors stop being redirected.
- Change every passwordWordPress admins, hosting panel, database, SFTP or SSH, and the email accounts linked to them.
- End all sessionsLog out every user everywhere, and replace the security keys (salts) in wp-config.php.
- Tell your hostThey may have logs, malware scan results and a clean snapshot you do not.
- Write things downNote what you saw and when. You may need it for Google, your host or the PDPC.
Take a copy before you clean
It feels wrong to back up a hacked site, but do it. Download a full copy of the files and export the database before you change anything. Label it clearly as infected so nobody restores it by accident.
The copy does two jobs. First, it preserves evidence: modified dates on files, the rogue user record, the injected database rows. Those clues tell you how the attacker got in, and deleting them blind means guessing. Second, it gives you a rollback point if the cleanup breaks something, such as a checkout page that depended on a plugin you removed.
If you can, do the detailed investigation on a separate copy rather than on the live server. Our note on what a staging site is explains the kind of environment that works for this.
Find out how they got in
Cleaning without closing the entry point is mopping the floor with the tap still running. The usual suspects:
- An outdated plugin or theme with a published vulnerability. Compare every installed version against the latest release, and search the plugin name plus "vulnerability".
- A stolen or guessed login. Check the user list, and if you have an activity log, look for logins at odd hours or from unfamiliar countries.
- A nulled theme or plugin downloaded from a sharing site, which often arrives with a backdoor already inside.
- A neighbouring site on the same hosting account that was infected first. Old test sites and abandoned subdomains are common culprits.
Server access logs help here. Ask your host for them, and look for repeated requests to one plugin's files or to unusual PHP files just before the first sign of trouble. If your hosting cannot provide logs or separate sites from each other, that is worth addressing too; our guide to web hosting explained for Thai businesses covers what to look for.
Clean the files
The safest principle is replace, do not repair. Trying to spot malicious lines inside thousands of files is slow and error prone; replacing whole folders with known-good copies is faster and more reliable.
- Replace WordPress core. Download a fresh copy of the same version from WordPress.org and replace the wp-admin and wp-includes folders completely. Replace the root files too, except wp-config.php.
- Check wp-config.php by hand. Compare it with wp-config-sample.php and look for unfamiliar code, especially long encoded strings or include lines.
- Reinstall every plugin and theme from source. Delete the folders and reinstall from WordPress.org or the developer's own download. Do not keep anything you cannot re-download. Replace nulled items with licensed ones or drop them.
- Hunt for PHP in uploads. The wp-content/uploads folder should hold images and documents, not PHP files. Any .php file there deserves suspicion.
- Check the root and hidden files. Look for unfamiliar files beside WordPress and for edited .htaccess rules that redirect mobile visitors or search engine traffic.
A malware scanner from your host or a security plugin can help you find leftovers, but treat a clean scan as a good sign rather than proof.
Clean the database and user accounts
Attackers hide in the database as well as the files, because database content survives a file replacement.
Users
Open the users table (wp_users, or your custom prefix) and the Users screen. Delete any account you cannot identify, and check that existing accounts have not been quietly promoted to Administrator. Then force password resets for everyone who remains.
Settings
In the options table, check that siteurl and home point to your real domain. A changed value can send every visitor elsewhere. Look at active_plugins for anything you did not install.
Content
Search posts and pages for script tags, iframes and links to gambling or slot sites. Spam pages are often created as posts with a status you do not normally see, or as thousands of rows at once, so sort by date and look for sudden bursts.
Scheduled tasks
WordPress keeps scheduled tasks (cron) in the options table. A malicious task can recreate a backdoor every hour. A cron viewer plugin lists them; remove any task whose hook name you cannot link to a plugin you trust. Also ask your host to check server-level cron jobs.
Should you restore a backup instead of cleaning?
If you have a backup from before the hack, restoring it can be much faster than cleaning file by file. It works well when three conditions are true: you know roughly when the infection started, the backup predates it, and the backup is stored somewhere the attacker could not reach.
The catch is that a restore brings back the old site with the same weakness. If the entry point was an outdated plugin, the restored site still runs that outdated plugin, and the same automated attack will find it again. So after restoring, immediately update everything, change every password and close whatever let them in.
Two more things to watch:
- Anything added since the backup, such as new orders, enquiries or blog posts, is lost unless you export it first. On a WooCommerce shop that may mean re-entering orders by hand.
- Infections often sit quietly for weeks before anyone notices, so the most recent backup may already contain the backdoor.
How long to keep backups and where to store them is covered in our WordPress backup guide; here the point is only that an older, off-site copy can save a lot of work.
Tell Google the site is clean
Once the site is clean and the hole is closed, deal with search results. Google's help for hacked sites walks through the process; the main steps are these.
Request a review
If Google Search Console, once set up for your site, lists a problem under Security issues, fix every example it shows, tick the box confirming you have fixed them, and request a review. Explain briefly what you found and what you changed. Google's documentation says most reviews take several days or weeks, and asks you not to resubmit before a decision, so plan for a wait.
Remove the spam URLs
The thousands of casino or slot pages the attacker created should now return a 404 or, better, a 410 status, which tells search engines the page is gone for good. Do not redirect them to your homepage. For urgent cases, the Removals tool in Search Console can hide URLs temporarily while Google recrawls.
Check the sitemap
Some hacks add a fake sitemap to push spam pages. Confirm that only your real sitemap is submitted in Search Console, and resubmit it so Google recrawls your genuine pages.
Is it a PDPA breach?
A defaced homepage is embarrassing. A hack that exposed customer names, phone numbers or addresses is also a legal matter, and our guide to PDPA penalties and fines shows what is at stake. While the technical work goes on, someone should ask: could the attacker have read or copied personal data?
Look at what the site stores. Contact form plugins often keep every enquiry in the database. WooCommerce keeps billing and shipping details. Membership and booking plugins hold accounts. If the attacker had admin or database access, assume they could see all of it unless you can show otherwise.
Thailand's PDPA, section 37(4), says the data controller must inform the Office of the PDPC without delay, and where feasible no later than 72 hours after becoming aware of the breach, unless it is unlikely to affect people's rights and freedoms. Where the risk is high, the people affected must be told too, with the steps being taken. The clock runs from when you become aware, not from when the cleanup ends, so start this assessment early. Check the PDPC website for the current reporting procedure and get legal advice on your situation.
How do you stop it happening again?
Once the site is clean, the aim is never to repeat this. Two-factor login, prompt updates, deleting unused plugins, licensed themes only, a firewall and off-site backups close most of the doors. Our WordPress security checklist for business sites goes through each layer in detail.
When to call for help
Bring in a professional if the site reinfects after cleaning, if it takes payments or holds customer accounts, if you cannot get into the hosting account or database, or if nobody on your team is comfortable editing files. For many owners, the real fix is making someone responsible for ongoing care; our explainer on what website maintenance involves describes what that covers.
We provide website maintenance services for WordPress and WooCommerce sites, which can include cleanup, hardening, updates and monitoring. Work is scoped per site, and our maintenance pricing page explains how quotes are put together. You can reach us on WhatsApp or by phone at +66 93 004 4098, or at service@websitedevelopmentbangkok.com, every day from 10:00 to 19:00 Bangkok time.
More on security and upkeep
Sources
- web.dev: Help for hacked sites (Google)
- Google Search Console Help: Security issues report
- WordPress.org: FAQ My site was hacked
- Personal Data Protection Act B.E. 2562 (2019), Royal Thai Government Gazette
- Personal Data Protection Committee (PDPC)
Builds and ranks the websites: the systems behind the 17 client sites whose Search Console numbers we publish. This guide was written by the Website Development Bangkok team. More about us