It’s Monday morning and a customer rings: “There’s something odd on your website.” Or Google shows “This site may be hacked” under your business name. Or your host has suspended the site and sent an email you have to read twice.

This guide is for that moment. It’s written in the order you should do things, and it assumes you’re not technical. Where you need help, we say so.

How you can tell

A break-in rarely looks like it does in films. The usual signs:

  • Google or your browser warns people away from your site (a red page that says “Dangerous site”).
  • Your homepage shows content you didn’t write, or visitors are sent to another website (often only on phones, often only when they arrive from Google).
  • Google lists pages under your domain that you never made: pills, betting, cheap designer trainers.
  • Your host has suspended the site, or says spam is being sent from your account.
  • There are WordPress users you don’t recognise, or plugins nobody installed.
  • Your admin password no longer works.
  • The site is suddenly very slow, or emails from your domain start landing in people’s spam.

One of these is enough. Don’t wait for a second.

The first 24 hours

1. Stay calm, take notes, write down the time. Note what you see, since when, and what was done to the site in the last few days (a plugin installed? a password shared? an update run?). Take screenshots. You’ll need these notes for your host, for whoever cleans the site and possibly for the ICO.

2. Take the site offline. Don’t delete it, just switch it off: turn on maintenance mode, or ask your host to suspend the domain for now. That protects your visitors, whose computers could otherwise be infected from your site, and it protects your standing with Google, which counts every hour the malware is up. Nobody has ever lost a customer over two days of “Back shortly”.

3. Call your host. They see more than you do: whether other customers on the same server are affected, when the break-in started, which files changed. Many hosts keep their own backups, and some offer a clean-up service. Ask about both.

4. Keep two copies. First, the current, infected state (files and database), so someone can work out later how they got in. Second, find your last clean backup: which backups exist, from which dates, at your host or in a plugin? Write the dates down. Yesterday’s backup is probably infected too; the break-in often happened weeks ago.

5. Change every password. Every one, not just WordPress:

  • every WordPress account with admin rights (yours, the agency’s, the one your nephew set up in 2021),
  • your hosting account,
  • FTP and SFTP,
  • the database,
  • the email account that can reset your WordPress password.

Use long, unique passwords from a password manager. Also replace the “security keys” in the wp-config.php file (WordPress has a generator for them); this logs out anyone still signed in. And have your own computer scanned for malware. Surprisingly often the password didn’t leak from the website at all, but from an infected laptop.

6. Decide: restore or clean. There are two ways back to a clean site.

  • Restore a clean backup. The quickest way, if you have a backup from before the break-in and not much has changed since. Then update WordPress, your theme and every plugin straight away, or the intruder walks back in through the same door.
  • Clean it. When there is no clean backup, or it’s too old. Scanner plugins such as Wordfence or Sucuri find most of it; WordPress itself and the plugins are uploaded fresh over SFTP, not through the admin, because the admin only overwrites files and never deletes any. The places to check closely: the wp-content/uploads folder (there should be no .php files in it), the .htaccess file, the list of users, the list of plugins and the scheduled tasks. This is a job for someone who has done it before. A professional clean-up costs from a few hundred pounds to over a thousand, depending on the damage. That’s usually cheaper than a week of your own evenings.

7. Once it’s clean: change every password again. Yes, again. You changed the first ones while the intruder may still have been watching.

The week after

Google. Add your site to Google Search Console if it isn’t there yet. The Security issues report shows what Google found. Once the site is clean, request a review there; the warning usually goes within a few days. Check Bing Webmaster Tools and Google’s Safe Browsing site status too.

Email. If spam went out from your server, your IP address may be on blocklists, and your ordinary emails may not arrive. Your host can help you get it removed. Also check your mailboxes for forwarding rules you didn’t set up.

Data protection. Was there personal data on the server (contact form entries, customer accounts, newsletter addresses, a shop), and could the intruder have seen it? Then it’s a personal data breach. Under UK GDPR (Article 33) you report it to the ICO, the UK’s data protection regulator, without undue delay and where feasible within 72 hours of becoming aware of it, unless it’s unlikely to put anyone at risk. If the risk to the people concerned is high, you must tell them too (Article 34). It sounds dramatic, but it’s routine: the ICO has a self-assessment that tells you whether to report, an online form (allow half an hour; it can’t be saved halfway) and a helpline on 0303 123 1113, weekdays 9am to 5pm. A report on time, with your notes from step 1, is your best protection against trouble later. If you’re still unsure, ask a solicitor before the 72 hours are up. Customers in the EU? Their data falls under the EU GDPR as well, with the same 72 hours.

Fraud. If money went missing or customers were tricked through your site, report it to Report Fraud, which replaced Action Fraud in England, Wales and Northern Ireland (0300 123 2040). In Scotland, call Police Scotland on 101.

Customers. If visitors saw the hacked site, tell them briefly and honestly: what happened, that it’s fixed, what they should do (usually nothing). A line on the website and in your next email is enough. Silence comes back to bite you.

Find the cause, or it happens again

Cleaning without finding the cause is like mopping the floor with the tap still running. The usual ways in, most common first:

  1. An outdated plugin or theme with a known flaw. Flaws are published, and attackers scan automatically for sites that haven’t updated yet.
  2. A weak or reused password, often on an old account nobody uses any more.
  3. A flaw in WordPress itself or in PHP, as in July (wp2shell) and in October 2026 (PHP2Shell). What counts then is how quickly your host and you react.
  4. Another customer on the same server, on cheap hosting that doesn’t keep accounts apart properly.
  5. The computer you log in from.

Whoever cleans your site should tell you which one it was. If they can’t, ask.

So it doesn’t happen again

  • Update WordPress, your theme and plugins within days, not months. Turn on automatic updates wherever you can.
  • Delete plugins you don’t need, don’t just deactivate them.
  • Limit admin accounts to the people who work on the site today. Everyone else gets a lower role, or none.
  • Two-factor login for every admin.
  • Daily backups, stored somewhere other than your web space, and once a year a test that a backup really restores.
  • Keep your PHP version on one that still gets security fixes (how to check it).
  • A scanner plugin that tells you before a customer does.

The NCSC’s Small organisations guide to cyber security covers the same ground for your whole business, not just the website, and its Response & Recovery guide helps you plan for the day it happens.

That’s the honest list. It’s long, and it stays long, because a WordPress site is made of many parts and every one of them needs looking after.

If you never want to go through this again

There’s a shortcut on that list: a website without the parts intruders come through. Johnny moves your WordPress site, same look and same addresses, to a site that is delivered as finished pages. No PHP, no plugins, no admin login and no database on your domain: nothing for you to update ever again, and far less for anyone to attack. We don’t say unhackable; your site is still on the internet. But the five ways in above are gone.

We can move a site that has been hacked, as long as a clean copy can be reached: a backup, a staging copy, or the pages as they were before the break-in. Tell us in the note when you send your address. We rebuild from the clean copy and look at every page before you see the preview. If there’s no clean copy, we tell you before you pay.

Sources