Do Not Panic, But Act Fast
Discovering your website has been hacked is stressful, but panicking leads to mistakes. Take a deep breath and follow this step-by-step process. The sooner you act, the less damage the malware causes.
Step 1: Take the Site Offline
Put your site in maintenance mode immediately. This prevents visitors from being exposed to malware and stops Google from flagging your site with security warnings. Most security plugins have a maintenance mode feature.
Step 2: Change All Passwords
Change every password associated with your website: WordPress admin, hosting control panel, FTP/SFTP, database, and email accounts linked to the site. Use strong, unique passwords for each.
Step 3: Scan for Malware
Run a full scan with your security plugin (Wordfence, Sucuri, or iThemes Security). The scan will identify infected files, malicious code injections, and suspicious modifications. Document everything it finds.
Step 4: Identify the Infection Type
Defacements: Your site content is replaced with attacker messages. Usually easy to clean by restoring from backup.
Backdoors: Hidden code that gives attackers persistent access. Harder to find and remove completely.
SEO spam: Hidden links or pages injecting spam into search results. Check your sitemap and page source for injected content.
Malware downloads: Your site serves malware to visitors. Critical - take offline immediately.
Step 5: Clean Infected Files
For known infections, replace infected files with clean versions from a fresh WordPress download. For custom files, manually remove the malicious code. Be thorough - a single remaining backdoor can reinfect your entire site.
Step 6: Restore from Backup
If you have a clean backup from before the infection, restoring it is the fastest and most reliable cleaning method. Restore both files and database. Change all passwords before bringing the site back online.
Step 7: Update Everything
After cleaning, update WordPress core, all themes, and all plugins. The vulnerability that allowed the hack may have been patched in a recent update. Also update PHP to the latest stable version.
Step 8: Harden Security
Implement all security measures from the security checklist: 2FA, security plugin, file permissions, changed login URL, and monitoring. The hack happened because of a vulnerability - close it permanently.
Step 9: Bring the Site Back Online
After cleaning and hardening, remove maintenance mode. Monitor closely for the next few days. Check for any signs of reinfection.
Step 10: Request Security Review
If Google flagged your site with a security warning, submit a review request through Google Search Console after confirming the site is clean. Google will recrawl and remove the warning.
When to Call a Professional
If the infection is severe, involves backdoors, or you are not technically confident, hire a professional. Malware removal services cost ₹5,000-₹15,000 and provide thorough cleaning with a guarantee.