Last updated: July 2026 | By CareWP Team
Finding out your WordPress site has been hacked is one of the worst moments in running a business online. Your site might be redirecting visitors to spam pages, flashing a Google “This site may be hacked” warning, or simply behaving strangely. The good news is that most hacked WordPress sites can be recovered, and knowing the right steps in the right order makes all the difference.
Table of Contents
Quick answer: To fix a hacked WordPress site, isolate it in maintenance mode, change every password (WordPress, hosting, database, FTP), scan for and remove malicious files and backdoors using a tool like Wordfence or Sucuri, restore from a clean backup if one exists, update all software, and remove any unfamiliar admin accounts. If you’re not confident doing this yourself, a professional recovery service can usually clean and restore a site within 24 to 48 hours.
CareWP is a Perth-based WordPress maintenance service that handles hacked site recovery for Western Australian businesses, and this guide walks through exactly what that process involves, whether you tackle it yourself or bring in help.
How Common Is This, Really?
WordPress powers a huge share of the web, which makes it a constant target. Roughly 13,000 WordPress sites are hacked every day worldwide, adding up to more than 4.7 million a year. In 2025 alone, security researchers logged over 11,000 new vulnerabilities, and 91% of them were found in plugins rather than WordPress core itself. Attackers now move fast too, with exploits for newly disclosed vulnerabilities often appearing within about five hours.
2026 has already seen several large-scale incidents that are worth knowing about, including a campaign where more than 30 trusted plugins had backdoor malware slipped into their updates, and a separate operation (dubbed WP-SHELLSTORM) that compromised over 17,000 sites through a single caching plugin flaw. If your site runs plugins that haven’t been updated in a while, this is exactly the kind of risk you’re carrying.
Step 1: Contain the Damage Immediately
Before you touch a single file, stop the bleeding.
- Put the site in maintenance mode. This protects visitors from malware, phishing redirects, or defaced pages while you work.
- Change every password. WordPress admin accounts, hosting control panel, database, FTP/SFTP, and any connected email accounts. Assume all of them are compromised.
- Take a fresh backup of the hacked state. Label it clearly as your “before cleanup” snapshot. If you make a mistake later, you can roll back to this exact point rather than losing evidence of what happened.
- Locate your last known clean backup. Your host may keep automatic backups; check how far back they go relative to when the hack likely started.
Step 2: Work Out What Happened
You can’t fix what you haven’t identified. Common signs of a WordPress hack include unexpected redirects, new admin users you didn’t create, a spike in outbound emails or server resource use, unfamiliar files in `wp-content`, and warnings in Google Search Console.
Run a full scan using a reputable security plugin such as Wordfence or Sucuri. These tools compare your files against known-clean WordPress core files and flag anything that’s been modified or added. Check your hosting error logs and access logs too, since they often show the exact entry point the attacker used.
Step 3: Remove Malware and Backdoors
This is the part most site owners get wrong, because attackers rarely leave just one infected file.
- Replace core files rather than editing them. Download a fresh copy of WordPress core from WordPress.org and overwrite the existing `wp-admin` and `wp-includes` folders. Never edit `wp-config.php` or your `wp-content` folder during this step, since that’s where your themes, plugins, and uploads live.
- Search for backdoors. Attackers commonly plant hidden files with names like `shell.php`, `c99.php`, or randomly generated filenames designed to blend in. Search your entire file structure, not just the obvious folders.
- Check the database. Malicious code is frequently injected directly into the `wp_options` and `wp_posts` tables, not just the file system. A security scanner that checks the database as well as files will catch more than one that only looks at files.
- Review every user account. Delete or downgrade any admin account you don’t recognise. Hackers often create a new admin user specifically so they can walk back in after you think you’ve cleaned up.
Step 4: Update Everything and Lock It Down
Once the site is clean, update WordPress core, every theme, and every plugin to their latest versions. If you can’t access wp-admin, you can update manually via FTP by downloading fresh files from WordPress.org.
Then harden the site so this doesn’t happen again:
- Enforce two-factor authentication (2FA) on all admin logins
- Remove any plugins or themes you’re not actively using
- Enforce strong, unique passwords for every user
- Set up a web application firewall if you don’t already have one
- Request a security review in Google Search Console if your site was flagged
DIY vs Professional Recovery: What’s the Real Difference?
| Factor | DIY Recovery | Professional Recovery |
|---|---|---|
| Typical cost | Free (your time) to $100+ in plugin/tool costs | $450 to $1,500+ depending on severity |
| Typical timeline | 24 to 72 hours of manual work | Often same-day to 48 hours |
| Risk of missing something | Higher, especially with hidden backdoors | Lower, with database and file-level scanning |
| Best suited to | Simple, single-file infections on sites you know well | Widespread infections, blacklisted sites, or business-critical sites |
| Ongoing prevention | Requires your own monitoring going forward | Often bundled into an ongoing maintenance plan |
For Perth businesses running WooCommerce stores, booking systems, or client-facing sites, the cost of downtime while you learn malware removal on the fly usually outweighs the cost of professional help. A recent backup is still the single biggest factor in how fast recovery goes, whether you do it yourself or hire it out.
How CareWP Handles Hacked Site Recovery
When a Perth business comes to us with a hacked site, our engineers scan files and database tables, remove malware and backdoors, restore from clean backups where available, and harden the site against reinfection, all before pushing anything live through a staging environment. Recovery is typically handled by a dedicated engineer rather than a rotating support queue, and our ongoing maintenance plans include the monitoring that catches these issues before they become full-blown hacks.
If your site is already showing signs of compromise, don’t wait. The longer malware sits on a site, the more likely it is to spread, get blacklisted by Google, or damage customer trust. Get in touch and we’ll assess the situation and get you a clear recovery plan.
Frequently Asked Questions
How do I know if my WordPress site has been hacked?
Common signs include unexpected redirects to spam sites, unfamiliar admin users, a Google Search Console warning, sudden spikes in server resource use, or your host suspending the account for abuse complaints.
How much does it cost to fix a hacked WordPress site in Australia?
Costs typically range from $450 for a straightforward malware cleanup to $1,500 to $3,800+ for widespread infections involving backdoors, blacklisting, or database corruption.
Can I fix a hacked WordPress site myself?
Yes, if the infection is isolated and you’re comfortable working with files, databases, and security plugins. Widespread infections with backdoors are much harder to fully clean without specialist tools.
Will my site get blacklisted by Google if it’s hacked?
It can. If Google’s crawlers detect malware or spam redirects, they may flag your site with a warning in search results until you clean it up and request a review through Search Console.
How do I stop my WordPress site from getting hacked again?
Keep WordPress core, themes, and plugins updated, enforce 2FA and strong passwords, remove unused plugins, use a firewall, and maintain clean off-site backups. Ongoing WordPress maintenance covers all of this.
