WordPress's own guide for a hacked site, FAQ My site was hacked, says finding and removing the hack "will be the most daunting part of the entire process". I don't clean up hacked sites, so this isn't a pitch for a clean-up. It reports what that guide, Google's help page for site owners and the Australian Cyber Security Centre's page Help during a cybercrime say.
WordPress's guide was last updated on 26 July 2026. I read Google's page on 25 October 2026. The Australian Cyber Security Centre page says it was last reviewed on 11 April 2023.
Signs that something's wrong
WordPress's guide describes a hack as "a very ambiguous term" and gives some of the clear signs. It calls them "a couple of" the indicators, so the list isn't complete.
- Google or Bing warns people away from the site.
- Your host, the company that hosts the site, has switched it off.
- The site has been flagged for spreading malware, which Google's page defines as software designed to harm devices or their users.
- Visitors say their antivirus is flagging the site.
- You've been told the site is being used to attack other sites.
- Something happens that nobody authorised, such as new user accounts being created.
- You can see that the site has been hacked when you open it in a browser.
There is a way back, and it's hard
Both guides lay out a way back. WordPress's says "all is not lost" and that "you will recover from this". Google's describes replacing the affected files with the last good backup, or removing the spammy content, and then asking Google to review the site.
WordPress's steps are, in its words, "not all encompassing", because "it would be impractical to account for every scenario". These are the parts the guides call hard.
- More than one kind of malware. Google's page says a site might be infected with more than one type, and to be thorough.
- An incomplete list. Google says the list of affected pages in its report "is not necessarily complete", and that fixing the issue on just some pages "will not earn you a partial return to search results".
- Working out how they got in. WordPress's guide says that in many instances it's "very difficult for website owners" to do this, because of a lack of technical knowledge or of available data. It says the goal is to understand how the attackers got in, so they can't abuse it again.
- Starting over. WordPress's guide says purging everything and starting over is possible "in some cases" and "just not possible" in many instances. It describes reinstalling parts of the site instead.
- Where it started. WordPress's guide says that in many instances an infection begins on the owner's own computer, where it can capture the logins used to manage the site.
My reading
Those are the guides' words, not a verdict on any clean-up. My reading is that a clean-up is a piece of work with several unknowns, and I wouldn't sell one as a guarantee.
Who the guides point you to
- Your host. WordPress's guide says a hack may have affected more than your site, especially on shared hosting, where many sites share one server. It says your hosting provider might also be able to confirm whether it's a hack or a loss of service.
- Someone who can read the code. Google's page says fixing a malware problem "requires the ability to read and understand code", and tells owners who aren't comfortable with that to find someone to help. WordPress's guide also mentions engaging a professional organisation.
- The Australian Cyber Security Centre. Its hotline is 1300 CYBER1 (1300 292 371), open 24 hours a day, 7 days a week. It says it can connect you with support services and guide you through reporting to police through ReportCyber, its reporting tool with the police. It says it can't provide technical support for your device or recover lost money. Its page describes hacking of devices and accounts rather than websites. For non-emergency police help it gives 131 444.
- Google's Search Console, a tool for site owners, if it's set up. Its Security issues report shows what Google found.
Pages worth acting on
Related page
What the latest WordPress and PHP security warnings mean
Three WordPress flaws with evidence of real attacks, two PHP fixes, and what isn't confirmed.
View pageRelated page
Why I don't start with WordPress
Where it still fits, where it can cost a service business, and what I build on instead.
View pageWhat to read next
What the latest WordPress and PHP security warnings mean for your website
Three WordPress core flaws have evidence of real attacks, and PHP fixed two critical flaws on 21 October. What's confirmed, what isn't, and the question to put to whoever hosts your site.
Read articleWhy I don't start with WordPress (and where it's still the right call)
A first-person case for choosing the platform last, with the one comparison I've measured and five questions to ask before you agree to any platform.
Read articleWebsite Redesign Central Coast: When Is It Time to Rebuild?
Most Central Coast business owners know their website isn't working well enough. The question is whether the answer is a quick improvement, a redesign, or a full rebuild. The difference matters a lot.
Read articleQuestions local business owners usually ask next
Moving to a lean custom build
The websites I build now are custom code, for businesses around Lake Macquarie, Newcastle and the Central Coast. A lean custom build is custom code written for your business. If you're weighing a rebuild after a hack, Get a Free Website Review. It looks at what's working, what's getting in the way and the clearest next step, and it isn't a security audit or a clean-up.