My WordPress site has been hacked

How you can tell

• Visitors are sent to another website, often only on phones or only when they arrive from Google, so you may not see it yourself.
• Searching Google for site: followed by your domain shows pages you never made, often in another language or selling something.
• There are administrator accounts you don't recognise.
• Google or a browser shows a red warning that the site is dangerous, or Google's results say it may be hacked.
• Your host has suspended the account for malware or for sending spam.

The first hour

1. Take a copy of everything, as it is now

   Download the website's files and its database from your hosting control panel, and keep them somewhere separate. Don't restore from this copy. It is the evidence, and the record of what the site looked like before anybody touched it.

2. Change the passwords, starting at the top

   The hosting account first, then the email account that receives its password resets, then every WordPress administrator, then the database and any FTP or SFTP accounts. If you think your own computer might be the way in, do this from a different device.

3. Look at the list of users

   In WordPress, under Users, remove any administrator you don't recognise. Note when they were created first, because that date is the best clue to when this started.

4. Stop it harming visitors

   If the site is sending people elsewhere or serving anything malicious, take it offline or put a holding page up while you clean it. Your host can do this for you.

5. Work out how they got in

   The usual answers are an out of date plugin or theme with a known weakness, a password that was used somewhere else and leaked, or a pirated copy of a paid plugin. Knowing which tells you what has to change, and whether cleaning up is enough.

Cleaning it up

The reliable way is a backup from before the attack. Restore it, then update WordPress, every plugin and every theme before the site goes back online. If you skip the updates, the same weakness lets them straight back in. Remember that a restore loses anything added since the backup was made.

If there is no clean backup, the job is to replace everything that could have been changed:

• Replace the WordPress core files with a fresh copy of the same version.
• Delete and reinstall every plugin and theme from its official source. Remove any you don't use.
• Look in wp-content/uploads for files ending .php. There shouldn't be any.
• Read wp-config.php and .htaccess for code you didn't put there.
• Replace the security keys in wp-config.php with new ones from WordPress's key generator. That signs everybody out, including the intruder.

If you can't be confident the site is clean after that, get somebody who can. A site that looks clean and isn't will be used again.

Afterwards

• If Google flagged the site, sign in to Google Search Console, look at the Security issues report, and request a review once the site is clean.
• Turn on two step sign in for every administrator.
• Turn on automatic updates for plugins, or make sure somebody applies them every week.
• Never install a paid plugin or theme from anywhere but its maker.

If customer details were on the site

If the site held personal data, such as enquiries, orders or customer accounts, and it may have been accessed, you may have to report the breach to the Information Commissioner's Office within 72 hours of finding out. Not every breach needs reporting: it depends on the risk to the people whose details they are. The ICO's website has a self assessment to help you decide, and it is better to use it on the first day than the fourth.