If you're reading this because your WordPress site is currently compromised, here's the most important thing first: stay calm, don't panic-delete anything, and don't try to log in repeatedly through the admin URL. The site can be recovered, and the next few hours of decisions will determine whether the recovery is clean or whether you're going to be fighting the same problem again next month. Most WordPress compromises are recoverable. They're also entirely preventable from happening a second time, which is the part most owners don't fully internalize until after the first one.
This is the practical guide we'd hand someone in the middle of an incident, followed by the longer answer about why these things happen and how to make sure they don't again. We deal with this regularly enough to know what works and what wastes critical time. If your site is down or serving malware to your customers, start at the top.
The immediate triage (first hour)
The first hour is about containment, not cleanup. Cleanup happens after you've stopped the bleeding.
Take the site offline temporarily. If your site is serving malware, phishing pages, or visibly defaced content to your customers, getting it offline is the priority — not preserving uptime. Your host can put up a maintenance page, or you can switch DNS to a temporary page. Every hour a compromised site is live, your domain's reputation degrades and Google may flag you, which is harder to recover from than the hack itself.
Change all passwords from a clean device. Not the device you usually use — the attacker may have credentials cached there. From a different computer or phone, change the WordPress admin password, the hosting account password, the FTP/SFTP password, the database password, and any connected services (email, payment processors, anything API-connected). Use a password manager and generate unique strong passwords for each.
Contact your host. Managed WordPress hosts (WP Engine, Cloudways, Kinsta, Pressable, Flywheel) have security teams that handle this regularly. They can often identify the entry point, isolate the site, and restore from a clean backup. If you're on shared hosting, you're more on your own — which is one of the reasons hosting is a business decision, not a commodity purchase.
Take a backup of the compromised site. Counterintuitive, but important. The compromised state contains forensic information about how the attacker got in. Before anyone restores from a clean backup, capture the current state so the entry point can be identified and closed. Otherwise you'll restore a clean version, the attacker will use the same hole, and you'll be hacked again within days.
The cleanup (next 24 to 48 hours)
Once containment is in place, the actual cleanup begins. This is where most owners want to act fast and where acting fast usually costs them.
Identify the entry point. Most WordPress compromises trace to one of four causes: an outdated plugin with a known vulnerability, a weak or reused admin password, a compromised hosting account, or a vulnerable third-party theme or plugin from an untrusted source. Knowing which one matters, because it determines how to prevent recurrence. Your host's logs, the site's modification timestamps, and any security scanning tools (Wordfence, Sucuri, Patchstack) will point at the cause.
Restore from a clean backup, not the live site. "Clean" means a backup taken before the compromise occurred. If you have daily backups going back at least 30 days (which you should), find the most recent one that's clean and restore from that. If you don't have clean backups, the cleanup gets much harder — every file has to be inspected and either verified or replaced.
Update everything. WordPress core, every theme, every plugin. Then remove any plugin or theme you're not actively using. The fewer dependencies on the site, the smaller the attack surface.
Scan and verify. Run a malware scan with at least two different tools. Check for unfamiliar admin accounts (delete them). Check for unexpected files in wp-content/uploads. Verify .htaccess and wp-config.php haven't been modified. If you're not sure how to do this, this is where you should be calling someone, not figuring it out.
Submit to Google for review. If your site was flagged as malicious or phishing in Search Console, submit it for re-review once cleaned. This can take days, and the reputation hit lingers.
Why WordPress sites get hacked (the real reasons)
Most "WordPress was hacked" stories are really "an unmaintained WordPress site running outdated plugins on shared hosting with weak passwords was hacked." The distinction matters because it points at what's actually preventable. The platform itself receives constant security updates and is no less secure than other major CMSes. What varies enormously is how each site has been maintained.
The real causes, in roughly descending order of frequency:
Outdated plugins. A plugin with a known vulnerability that has a patch available, sitting unupdated for months, is the single most common entry point. Automated attack tools scan the web continuously looking for sites running vulnerable versions, and they find them.
Weak or reused passwords. Admin passwords that are simple, short, or reused from other accounts that have been in data breaches. Brute-force tools try common credentials against every WordPress site they can find, and a real number of sites have "admin" / "password123" still active.
Themes or plugins from untrusted sources. Nulled or pirated premium plugins frequently come with backdoors baked in. Free themes from sketchy sources do the same. The download was free; the cleanup costs thousands.
Compromised hosting environment. Less common but harder to fix when it happens — shared hosting where another site on the same server was compromised and the attacker moved laterally.
Phishing of admin credentials. Increasingly common as attackers get better at targeted phishing. Admin clicks a convincing-looking email, enters credentials on a fake login page, attacker has the keys.
How to make sure it doesn't happen again
The good news is that nearly all of this is preventable. The layered defense isn't expensive or complicated; it's just disciplined. We've laid out the full security posture in our WordPress development guide, but the essentials are worth restating here.
Mask the admin URL. The default WordPress login lives at the same well-known path on every site, which is the first thing every attacker tries. Moving it eliminates a huge share of automated attacks instantly. Costs nothing.
Two-factor authentication on every admin account. Mildly annoying. Genuinely the single most effective protection against credential-based attacks. The math on inconvenience versus consequence isn't close.
A web application firewall. Filters out known bad actors and obvious attack patterns before they reach your server. Most managed hosts include one; otherwise, add one (Wordfence, Sucuri, Cloudflare).
Managed hosting. Real managed WordPress hosts run automated security monitoring, isolate sites from each other, and have teams that respond to incidents. The cost difference between shared hosting and managed hosting is real, and so is the difference in outcome. Website security and business trust goes deeper on why this is a business decision, not a technical one.
Disciplined plugin management. Fewer plugins. Each from reputable sources. Kept up to date. Removed when not in use. This single discipline prevents most compromises in the first place.
Verified backups. Daily backups, tested for restore at least monthly. A backup you've never tested isn't a backup; it's a hope.
Active maintenance with a real human. All of the above only works if someone is actually doing it. A maintenance plan with an unresponsive provider is worse than no plan, because you're paying for security you don't actually have.
Where Lion Ridge fits
We don't enjoy emergency cleanup work, but we do it when clients need it, and we'd rather build the relationship before the incident than after. The sites we manage don't get hacked, because the security work happens before the attempt succeeds — masked admin URLs, 2FA on every account, managed hosting, disciplined plugin management, verified backups, real monitoring.
If you're recovering from an incident right now and need help, or if you've never had one and want to make sure you don't, tell us what you're dealing with. We'll give you a straight read on what it takes to be in the second group rather than the first.
