Strange redirects, spam pages in Google, a browser warning or an email from your host: discovering a hacked website is stressful. Follow these steps in order.
Minutes 0 to 15: contain
- Do not delete everything in a panic. You may need evidence.
- Put the site in maintenance mode or ask your host to restrict access.
- Change passwords for WordPress admins, hosting, FTP, database and email, using a clean device.
- Turn on multi-factor authentication for admin accounts.
Minutes 15 to 30: assess
- Check for unknown admin users and remove them.
- Look for recently modified files, unknown plugins and suspicious code.
- Check Google Search Console for security issue warnings.
- Find your most recent clean backup.
Minutes 30 to 60: clean or restore
- If a clean backup exists from before the hack, restore it, then update everything immediately.
- If not, replace WordPress core files, reinstall plugins and themes from official sources and remove malicious code from uploads and the database.
- Scan again to confirm the site is clean.
After the first hour
- Find and close the entry point, usually an outdated plugin, weak password or nulled theme.
- Install a firewall and security monitoring.
- Request a review in Google Search Console if your site was flagged.
- Tell customers if their personal data may have been exposed, in line with UAE data protection obligations.
Prevent it next time
Keep everything updated, remove unused plugins, never use pirated themes, back up daily and use strong passwords with MFA.
Need help now? Our cybersecurity team handles malware cleanup and hardening, and our web team offers ongoing maintenance.
Frequently asked questions
How did my site get hacked?
Most often through outdated plugins or themes, weak or reused passwords, or pirated software containing backdoors.
Will Google remove the warning automatically?
After cleaning, request a review in Search Console. Warnings are usually removed once Google confirms the site is clean.
Should I rebuild the site from scratch?
Not usually. A thorough cleanup and hardening is enough in most cases.