WordPress site hacked: what I check first

You open the site and something is off. Random spam links in the footer. A weird admin user you did not make. Homepage swapped for a pharma page. Or Google is yelling about malware.

Below is what I actually check first on a hacked WordPress site, before anyone starts guessing plugins at random.

What hacked usually looks like

It is rarely one neat broken page. More often it is a mix: spam injections in post content, odd .php files in uploads, new admin users, redirected checkout, or search results showing a different site than the one you are looking at.

Write down what you are seeing. Screenshots help. So does the exact time it started if you know it.

Lock it down before you clean

• Change all admin passwords and hosting panel passwords
• Force logout every user session you can
• Take the site into maintenance if customers can still buy or submit forms
• Snapshot or back up what is there now, even if it is messy. You will want a copy before you overwrite anything

Cleaning while the door is still open just invites them back in.

Malware vs spam injections vs a defaced homepage

Not every mess is the same job.

• Spam injections hide links or hidden content in posts, themes, or widgets
• Malware / backdoors are usually PHP droppers in uploads, mu-plugins, or a compromised theme
• Defacement is the loud one: homepage replaced, scary banner, ransomware note

Knowing which one you are dealing with stops you fixing the wrong layer for two hours.

Hosting and plugin checks I run first

• Hosting malware scan and file change logs if they have them
• Recently modified files under wp-content, especially uploads
• Plugin and theme update history. Old contact forms and page builders show up a lot
• Users list for admins you do not recognise
• wp-config.php and .htaccess for odd includes or redirects

If you are not sure what a file is doing, do not delete it blind. Copy it off, then quarantine.

When a restore beats a clean

If you have a clean backup from before the funny business, restore often beats a week of whack-a-mole. Clean after restore: passwords, keys, leftover droppers, and whatever let them in.

If the only backup is already infected, you are into a proper clean and harden pass. That is the longer job.

Most of these jobs come down to locking the door, knowing whether you are looking at spam, a backdoor, or a loud defacement, then restoring from a clean backup when you have one. Do the password and session reset before you start deleting files. Cheers.