WordPress Site Hacked? What to Do in the First Hour

A minute-by-minute checklist for the first hour after a WordPress hack: confirm, keep the evidence, contain, lock every access, check your obligations.

Key Takeaways

Don't delete or restore anything yet. First write down what you see, then take a full copy of the infected site and ask your host for the logs. Evidence disappears quickly.

Contain before you clean: restrict access to the site or take it offline if it's stealing data, spreading malware or taking payments.

Change every access from a clean device: hosting panel, SFTP/SSH, database, every WordPress administrator, and the security keys in wp-config.php to log everyone out.

If personal data may have leaked, the GDPR 72-hour clock for notifying your data protection authority starts when you become aware of it.

The cleanup comes after the first hour. Plugins carried 91% of the 11,334 new WordPress vulnerabilities in 2025, and the weighted median time to first exploit was 5 hours (Patchstack).

Is your site down, redirecting visitors or leaking data right now? Call us on +33 6 42 45 95 16 or email info@fnb-solutions.com, then work through the checklist below while you wait. Everything in it is safe to do before an expert looks at the site, and it keeps the evidence an expert needs.

A hacked site triggers the urge to fix it immediately: restore yesterday's backup, delete the strange files, reinstall the plugins. In the first hour, those reflexes do more harm than good. They destroy the traces that show how the attacker got in, and they often leave the backdoor in place. This checklist is for site owners and managers, technical or not. It follows the order recommended in WordPress's own guidance for hacked sites: stay calm, document, then lock things down.

Minutes 0 to 10: confirm and write it down

Start by noting what makes you think the site was hacked. WordPress's guidance calls these indicators of compromise. The common ones:

a browser or Google warning that the site is dangerous;
visitors redirected to another site, often only on mobile or when arriving from Google;
pages in Google results that you never wrote (pharmacy, casino, Japanese-language pages);
new administrator accounts, or changes nobody on your side made;
your host suspending the site or warning you about outgoing spam;
a defaced home page.

Write down what you see, when you noticed it (with the time zone), and anything that changed recently: a new plugin, an update, a new user, a former provider's access. Take screenshots. This becomes the start of your incident report, and it saves hours later.

One precaution: if you suspect your own computer, check from another device. Stolen passwords are a common way in, and an infected laptop can steal the new ones as you type them.

Minutes 10 to 20: preserve the evidence

Before changing anything, keep a copy of the site as it is now, infection included:

Download a full copy of the files and an export of the database. Most hosting panels can do both. Label it clearly as infected and keep it away from the live server.
Ask your host for the logs (web server access logs, and FTP or panel login logs if available). Logs are often rotated after a few days. Without them, it's usually impossible to prove how the attacker got in.
Note the versions of WordPress, your theme and each plugin, from the dashboard if you can still get in.

This copy also protects you if the cleanup goes wrong: WordPress's guidance recommends one last snapshot, even of an infected site, before any cleaning.

Minutes 20 to 35: contain the damage

The goal is to stop the harm to your visitors and your business without destroying anything:

If the site steals data, distributes malware or takes payments, take it offline or replace it with a maintenance page served by the host. An e-commerce site should at least disable checkout.
Otherwise, restrict access to wp-admin (by IP address, through the host or a server rule) so the attacker can't keep using the dashboard while you work.
Tell your host. On shared hosting the infection may reach other sites, and the host may already be taking action, or may have suspended the account.
Don't restore a backup over the site yet. You don't know when the infection started, so the backup may be infected too, and restoring overwrites the evidence.

Minutes 35 to 50: lock every access

Do this from a clean device, and change every access point, not just your own WordPress password:

Access	What to do
Hosting account and control panel	New password, two-factor authentication, check the authorised users and contacts
SFTP / SSH	New passwords, remove keys you don't recognise, close plain FTP if it's still open
Database	New password for the database user, then update `wp-config.php`
WordPress administrators	Reset every admin password. List unknown accounts and lower their role rather than deleting them, so the evidence stays intact
WordPress security keys	Generate new secret keys and replace them in `wp-config.php`: this logs every session out, including the attacker's
The administrators' email accounts	Password reset links go there; secure them too
Search Console and analytics	Check for owners or users you don't recognise. Attackers add themselves to submit spam sitemaps

Change these passwords again once the site is clean. WordPress's guidance insists on it: passwords set during an active infection may already be compromised.

Minutes 50 to 60: check your obligations, decide who cleans

Personal data. If customer accounts, form submissions or orders may have been exposed, you're probably facing a personal data breach. Under article 33 of the GDPR, the controller must notify its data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach that is likely to put people at risk. In France, that's done through the CNIL's notification service, which accepts an initial notification while the investigation continues. If the risk to people is high, they must be told too (article 34).

Payments. If the site takes card payments, tell your payment provider.

Insurance. If you have a cyber or business insurance policy, read its notification clause now. Many require you to declare an incident quickly and to use approved providers.

Help and reporting in France. Cybermalveillance.gouv.fr helps victims assess the situation and find assistance, and 17Cyber, run with the police and gendarmerie, guides victims through reporting.

Who cleans. If you have the skills and the time, the cleanup can start now. If not, this is the moment to bring someone in, with the evidence you've kept.

What not to do in the first hour

Reflex	Why it backfires
Restore last night's backup straight away	The infection may be older, and you lose the evidence of how they got in
Delete the spam pages or strange files you can see	Attackers leave several backdoors; removing the visible part just tells them to come back
Rely on one cleanup plugin and call it done	Scanners help, but none catches everything, especially in the database
Reinstall plugins from the dashboard	WordPress's guidance recommends replacing files over SFTP: dashboard reinstalls overwrite files but don't remove the new ones attackers add
Announce it publicly before you know what happened	You may have to correct yourself; tell those directly affected first

After the first hour: the cleanup

The cleanup is a separate job, and it's where most of the work is: find every persistence mechanism (modified .htaccess files, fake plugins in mu-plugins, injected code in theme files, rogue users, scheduled tasks stored in the database), replace WordPress core, the theme and the plugins with clean copies, check core files against the official checksums (wp core verify-checksums), clean the database, close the entry point, and only then ask Google to review the site through the Security issues report. Google recommends one review request once everything is fixed: repeated requests can lengthen the review.

Our investigation of an SEO spam infection on WordPress walks through a real cleanup and the persistence mechanisms that make quick fixes fail. For hardening afterwards, WordPress's hardening guide is the reference.

Why it happened, and why it will happen again without updates

Most WordPress hacks don't come from WordPress itself. In Patchstack's report on 2025, 91% of the 11,334 new vulnerabilities found in the WordPress ecosystem were in plugins and 9% in themes, with only six in core. 46% had no patch available when they were disclosed, and the weighted median time to first exploit was 5 hours (Patchstack, State of WordPress Security in 2026).

Five hours means that updating "when we get round to it" isn't a security policy. Fewer plugins, active licences for premium themes and plugins, automatic updates where possible, and a maintenance contract that covers security are what keep a cleaned site clean.

Frequently asked questions

Should I take my site offline? Yes if it's stealing data, spreading malware, redirecting visitors or taking payments. Otherwise, restricting access to the dashboard is usually enough while you investigate. Either way, keep the files and database intact.

Can I just restore yesterday's backup? Not before you know when the infection started and how the attacker got in. A restore can bring back an infected copy, and if the entry point stays open, the site is reinfected within days.

Do I have to tell my customers? If their personal data may have been exposed and the risk to them is high, yes, under article 34 of the GDPR. In every case where personal data is involved, assess whether you need to notify your data protection authority within 72 hours.

How long does a cleanup take? It depends on how deep the infection goes and how many backdoors it left. A thorough cleanup takes days, not hours, and search rankings take weeks to recover once the spam pages are gone.

FNB Solutions responds to compromised websites and web applications: containment, cleanup, root cause and hardening, then monitoring. See our security and incident response service, or contact us now.

Sources

All insights →