Moatline

WordPress site hacked? What to do in the first hour

Don't panic and don't start deleting files. These are the steps that limit the damage and give you the best chance of a clean recovery.

By the Moatline team at Next Nova Technologies · Updated 12 October 2026 · 9 min read

How to know your WordPress site was hacked

  • Visitors get redirected to other sites, sometimes only on phones or only from Google.
  • A fake CAPTCHA or “verify you are human” box appears that asks visitors to press keyboard shortcuts.
  • Google or Chrome warns that the site is dangerous or “may be hacked”.
  • New admin users, plugins you didn't install, or plugins that are missing from wp-admin but present in File Manager.
  • You can't log in, or your password suddenly stops working.
  • Your host emails you about malware or suspends the account.

What to do in the first hour

  1. Change passwords from a clean device. Start with your hosting/cPanel and email accounts, then WordPress administrators. If the hacker has your email, they can reset everything else.
  2. Back up the hacked site. Download the files and database before changing anything. It keeps the evidence and protects you if a cleanup step goes wrong.
  3. Contact your host. Ask which files their scanner flagged and when, and ask them to keep the access logs.
  4. Download the access logs. In cPanel this is Metrics → Raw Access. Logs are often kept for only a few days, and they show exactly how the attacker got in.
  5. Protect your visitors. If the site is redirecting people or showing fake pop-ups, turn on a maintenance page until it's clean.
  6. Scan the site. Install the free Moatline Malware Scanner and run a full scan to see every infected file, fake plugin and injected post.

Then follow our step-by-step guide to removing malware from WordPress.

How did they get in?

Finding the entry point matters: if you don't close it, the site will be hacked again. The most common causes we see:

  • Stolen or weak passwords. An attacker logs in as a real admin and uploads a malicious plugin. In the access log this looks like a login followed by update.php?action=upload-plugin.
  • Outdated plugins with known holes, especially file managers, page builders and form plugins.
  • Nulled premium plugins or themes downloaded from “free” sites. They often contain a backdoor from day one.
  • Leftover installer and backup files, such as old installer.php files from migration tools.
  • Another site on the same hosting account that was already infected.
If two of your sites on different hosting accounts are hacked in the same way, look for what they share: the same admin password, the same team computer, or the same plugin download.

Why hacked WordPress sites keep getting hacked again

When a site is reinfected days after a cleanup, something was left behind. Check these places:

  • Hidden admin users created by the attacker.
  • Fake plugins that hide themselves from the Plugins page.
  • wp-content/mu-plugins, which load automatically and don't show up as normal plugins.
  • PHP files in wp-content/uploads.
  • Scheduled tasks in the database that download the malware again.
  • Passwords and security keys that were never changed, so the attacker simply logs back in.

Stop it happening again

  • Turn on two-step login for every administrator.
  • Keep WordPress, plugins and themes updated, and delete what you don't use.
  • Turn off the built-in file editor and block PHP in the uploads folder.
  • Use a custom login address so bots can't find your login page.
  • Scan regularly, so the next infection is caught in days, not months.

Moatline's free plugin does all of these. See Lockdown and two-step login in the docs.

Frequently asked questions

Should I delete my hacked WordPress site and start again?
Usually not. Rebuilding takes far longer than a proper cleanup, and if you reuse the same passwords, plugins or hosting account the new site can be hacked the same way.
Will my host fix a hacked WordPress site?
Some hosts scan for malware and quarantine files, but most don't do a full cleanup or close the hole the attacker used. Half-finished host cleanups can even break the site.
Can a hacked WordPress site harm my visitors?
Yes. Current malware often targets visitors rather than the site itself, with fake CAPTCHA pages that trick them into installing malware or redirects to scam sites.
How do I know if my WordPress site is still hacked?
Run a full scan of files and the database, check for unknown admin users, and scan again a day later. If something reappears, a backdoor is still there.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides