The short answer
Do these four things first, in this order. Take a full backup of the site as it is right now, infected and all. Change your hosting, WordPress admin, database and FTP passwords. Put the site into maintenance mode so visitors stop landing on the infection. Then open Google Search Console and check Security Issues to find out what Google can already see.
Only after that should you start deleting anything. Cleaning before backing up is the single most expensive mistake here, because a half cleaned site with no copy of the original is much harder to recover than an infected one.
First, make sure it is actually a hack
A surprising number of emergencies turn out to be something else, and the fix is completely different, so spend two minutes ruling those out.
A white screen with no content is usually a PHP error from a bad plugin update, not an intrusion. A site that is down entirely, with a connection error, is often expired hosting or a domain that quietly lapsed. A browser warning about the certificate is an expired SSL, which looks alarming and is a ten minute fix.
What actually indicates a compromise:
- The site redirects somewhere else, usually a betting, pharmacy or adult site, and often only on mobile or only for visitors arriving from Google.
- Google results for your site show pages in Japanese, Chinese or Russian that you never created.
- A full red interstitial saying the site ahead contains malware or is deceptive.
- Admin users in your WordPress dashboard that you do not recognise.
- Your host has suspended the account for sending spam.
- Files in the root directory with names that look like random characters.
The mobile only redirect is the one people miss. Plenty of infections check the visitor's device and referrer, then behave normally for anyone typing the address directly on a desktop. The owner sees a perfectly fine site and assumes the customer was mistaken. If someone tells you your site sent them somewhere strange, believe them and test on a phone using mobile data, arriving from a Google search.
The first hour, step by step
- Back up everything, infected and allFiles and database, downloaded to your own machine. This is your evidence and your fallback. If a cleanup goes wrong at step six you will want this, and you cannot recreate it later.
- Change every passwordHosting panel, WordPress admins, database user, FTP or SFTP, and the email account those accounts recover to. Do the email account first, because if that is compromised everything else resets straight back to the attacker.
- Take the site down politelyMaintenance mode or a holding page. This protects visitors and stops Google crawling more infected pages while you work. A short outage costs far less than a search blacklist.
- Check Google Search ConsoleSecurity and Manual Actions, then Security Issues. Google will often name the problem and list sample infected URLs, which is the fastest diagnostic you will get for free. If you have never set up Search Console, do it now, verification takes a few minutes.
- Ask your host what they can seeServer logs show the entry point and the timing, and most Indian hosts will run a malware scan on request. On shared hosting also ask the question directly: was this site the entry point, or did it come from a neighbouring account on the same server.
- Now cleanReplace WordPress core and every plugin and theme with fresh copies from official sources rather than trying to repair files. Delete anything you do not recognise and cannot account for. Remove unknown admin users. Then scan again.
Why it comes back a week later
This is the part that turns a bad afternoon into a bad month. A site gets cleaned, everything looks right, and the redirect is back within days.
Almost always the reason is a backdoor. The original break-in installs a small file whose only job is to let the attacker back in later, and it is usually somewhere boring: the uploads folder, a file named to blend in with core files, an extra line in wp-config.php, or a scheduled task in the database that quietly reinstalls the payload. Clean the visible infection without finding that, and you have fixed the symptom.
Three places worth checking specifically, because scanners miss them more often than they miss malicious PHP:
- Unrecognised admin accounts, including ones created after you cleaned.
- WordPress scheduled tasks, which is where reinfection routines like to live.
- The uploads folder, which should contain images and documents and no executable PHP at all.
If a site has been reinfected twice, stop cleaning it. Rebuild from a known good backup taken before the infection date, or rebuild fresh and move only the content across. That decision feels like giving up and it is usually the fastest route back to a working site.
How these sites get in, and what that means for India
The numbers are not really about WordPress itself. Patchstack's security report for 2026 recorded 11,334 new vulnerabilities across the WordPress ecosystem during 2025, up 42 percent on the previous year. Of those, 91 percent were in plugins and 9 percent in themes. WordPress core accounted for six, all rated low risk.
So the platform is not the weak point. The add-ons are, and specifically the ones nobody is updating.
Speed matters too. The same report puts the weighted median time to first exploitation at five hours after a vulnerability becomes public, with roughly half of high impact issues exploited within a day. A monthly update routine is not a defence against that. Nothing personal is happening here either, and it helps to understand that: these are automated scanners working through lists of known vulnerable versions, and they found you because your plugin version matched a pattern.
There is one pattern we run into more in India than the global write-ups suggest, and it deserves saying plainly. A premium theme or plugin licence often costs more than the client's entire annual budget for the site, so a nulled version gets downloaded from a site offering it free. That software has been modified by whoever uploaded it. The backdoor is not an unfortunate risk in that transaction, it is the reason the free copy exists at all. Some activate immediately and some sit dormant for months, which is why the connection to a hack is rarely obvious afterwards.
If your site is running nulled software, no amount of cleaning will hold. Replacing it with a legitimate licence, or with a free alternative that does the same job, is the actual fix.
Worth noting alongside that: Patchstack found three times as many known exploited vulnerabilities in premium components as in free ones. Paying for a plugin is not by itself protection. Updating it is.
Getting the Google warning removed
Once the site is genuinely clean, this part is straightforward and mostly waiting.
In Search Console, go to Security and Manual Actions, then Security Issues, and use Request a Review. Describe what you found and what you did, briefly and specifically. Reviews commonly clear in 24 to 72 hours, though it can run longer.
Do not request the review early. If Google checks and the site is still infected, you have burned the attempt, and sites that get repeatedly flagged can be limited to one review request every 30 days. A day of extra checking is much cheaper than a month of a red warning screen in front of your homepage.
Recovering rankings after a clean is usually a matter of weeks rather than a permanent loss, assuming the infection was caught reasonably quickly. Long running spam page injections are the exception, because Google has by then indexed a large number of junk pages under your domain and those take time to clear.
When to stop and hand it over
Plenty of infections are genuinely fixable by a confident owner, and we would rather you saved the money where you can. Hand it over when any of these are true.
- The site has been reinfected after a cleanup.
- It takes payments or holds customer data, where a breach is a legal matter and not only a technical one.
- Your host has suspended the account, which usually means the mess extends past your site.
- There is no clean backup and you would be rebuilding from what is there.
- You have been at it for several hours and the number of suspicious files keeps growing.
That is roughly the point where a professional cleanup costs less than continuing, mostly because the expensive part of this work is finding the backdoor rather than deleting the malware.
Making the next one not happen
Prevention here is dull and almost entirely effective.
- Update weekly, not monthlyGiven a median of five hours to first exploitation, the gap between updates is the actual risk. Weekly is a reasonable floor for a small business site.
- Delete what you are not usingDeactivated plugins are still on the server and still exploitable. Inactive is not removed.
- Nothing nulled, everIf a licence is genuinely out of budget, use a free alternative. A free plugin from the official directory is far safer than a pirated premium one.
- Backups you actually holdOffsite, automatic, and restorable. Test a restore once so you know it works before you need it at midnight.
- Two factor on admin accountsFree, quick, and it removes the entire category of password guessing attacks.
- Fewer administratorsMost people who log in need Editor, not Administrator. Old developers and ex staff should be removed the day they stop working with you, which is also an ownership question worth reading about in who actually owns your website.
Common questions
What should I do first if my WordPress site is hacked?
Back up the site exactly as it is, infected and all, before changing anything. Then change every password including hosting, WordPress admin, database, FTP and the recovery email address. Put the site into maintenance mode so visitors stop reaching the infection, and check Google Search Console under Security Issues to see what Google has already detected. Only start deleting files after those four steps, because cleaning without a backup is what turns a recoverable hack into a rebuild.
Why does my site keep getting hacked after I clean it?
There is almost certainly a backdoor left behind. The original intrusion installs a small file whose only purpose is to allow re-entry later, typically hidden in the uploads folder, disguised among core files, added to wp-config.php, or scheduled as a recurring task in the database. Removing the visible malware without finding that file fixes the symptom only. If a site has been reinfected twice, rebuilding from a clean pre-infection backup is faster than continuing to clean it.
Are nulled or pirated WordPress themes really that dangerous?
Yes, and the risk is not incidental. Paid software distributed free from an unofficial source has been modified by whoever uploaded it, and the injected backdoor is the reason that free copy is being distributed. Some payloads activate on install and others stay dormant for weeks or months, which is why owners rarely connect a later hack to the theme they installed. A site running nulled software cannot be secured by cleaning it. The software has to be replaced with a legitimate licence or a free alternative.
How long does it take to remove a Google malware warning?
After you request a review in Google Search Console under Security and Manual Actions, the warning commonly clears within 24 to 72 hours, though it can take longer. Only request the review once the site is genuinely clean. A failed review wastes the attempt, and sites that are repeatedly flagged may be limited to one request every 30 days.
Will being hacked destroy my Google rankings permanently?
Usually not, if it is caught reasonably quickly. Most sites recover their previous positions within weeks of being cleaned and the warning being lifted. The harder case is a spam injection that ran undetected for months, because Google will have indexed a large number of junk pages under your domain and clearing those out takes longer than fixing the site itself.
Is WordPress just insecure? Should I move to something else?
The core software is not the problem. Of the 11,334 WordPress ecosystem vulnerabilities Patchstack recorded during 2025, 91 percent were in plugins and 9 percent in themes, with only six in WordPress core, all low risk. What gets sites compromised is unmaintained add-ons, pirated software and old versions. A well maintained WordPress site with few plugins is fine. A neglected site on any platform is not.
If you are in the middle of this right now
Take the backup before anything else, then work down the list. If you get stuck, or the site is back to redirecting a few days after you thought you had fixed it, message us on WhatsApp with the domain and we will tell you what we can see from the outside.