--- title: "What to Do When Your WordPress Website Has Been Hacked" id: "120401" type: "post" slug: "wordpress-compromised" published_at: "2026-05-02T09:38:12+00:00" modified_at: "2026-08-14T18:12:49+00:00" url: "https://speckyboy.com/wordpress-compromised/" markdown_url: "https://speckyboy.com/wordpress-compromised.md" excerpt: "It’s perfectly normal to feel scared or frustrated when your WordPress site has been compromised. Take a breath, and follow this guide for dealing with a hacked WordPress website." taxonomy_category: - "WordPress" - "WordPress Developer" taxonomy_post_tag: - "Learn WordPress" --- # What to Do When Your WordPress Website Has Been Hacked Last Update: August 14, 2026 By Eric Karkovack [WordPress](https://speckyboy.com/category/wordpress/) / [WordPress Developer](https://speckyboy.com/category/wordpress/wordpress-developer/) It starts with a sinking feeling that something is amiss with your WordPress website. Maybe your [security plugin](https://speckyboy.com/8-free-plugins-secure-wordpress-website/) has alerted you to a changed file that you know you didn’t touch. Or you see some unfamiliar content within your post listing. Whatever the indicator, it leads to one conclusion: Your website has been hacked. What to do now? While it’s perfectly normal to feel scared and/or frustrated, it’s not the time to panic. Instead, it’s time to spring into action! Kind of like a superhero, but your weapons of choice are a security scanner and an FTP client. Still, you have the ability to save the day. Just follow our guide for dealing with a hacked WordPress website. ## Use Your Backups Managing a website – whether it runs on WordPress or not – means being prepared to act at a moment’s notice when something goes wrong. How do you do that? By [keeping regular backups](https://speckyboy.com/free-wordpress-backup-solutions/) of your entire site – including its database and files. Restoring clean versions of your files and data will quickly get your website back to a good place. If you don’t have a backup to turn to, recovering from a hack can be all the more difficult. Without a backup, well, it’s a matter of going through your installation with a fine-toothed comb. You’ll need to look for potentially malicious code, remove it and hope you’ve caught everything. There may be a saving-grace: Your web host may well have a clean backup to help you out. However, it’s still best to take matters into your own hands. Relying on others to bail you out of a tough spot isn’t a sustainable strategy. ![A person holding a hard drive.](https://speckyboy.com/wp-content/uploads/2020/05/wordpress-site-hacked-01.jpg) ## Change Passwords and Salt Keys Depending upon the vulnerability an attacker used to hack your site, they very well could have administrator access. Therefore, it’s best to change the passwords for every administrator account. If you have unused accounts lying around, consider deleting them. In addition, the site’s database password should also be changed. This could help prevent any MySQL injection attacks that may have been going on. Lastly, a quick change of your [WordPress salt keys](https://kinsta.com/blog/wordpress-salts/) is also recommended. This will kick out any logged-in users who may be snooping. ![Neon Lights](https://speckyboy.com/wp-content/uploads/2020/05/wordpress-site-hacked-02.jpg) ## Look for Hints of Changed Files If your website has been compromised, it’s not enough to simply restore a backup. It’s also important to try and figure out exactly what happened. The backup files may be clean, but they still could contain security holes that will lead to yet another hack. Therefore, it’s a good idea to download a copy of your hacked site *before* restoring that backup. Or, if your site is backed up daily, you may be able to just grab that latest copy if you suspect that it too has the same affliction. You may also want to run it through a security scanner, such as Sucuri’s free [SiteCheck](https://sitecheck.sucuri.net/) tool. This could potentially lead you directly to a specific security issue that caused the hack. Once you have a copy of your infected site, it’s time to dig through and look for clues. Here are a few items worth checking out: ### Check WordPress Core, Plugins and Themes One thing to keep in mind is that malicious code could be injected into any area of your WordPress website. That could be a core file, a plugin or theme. Even inactive items could have provided a backdoor. It’s also worth checking your server’s file permissions to make sure they’re in line with what WordPress [recommends](https://developer.wordpress.org/advanced-administration/security/hardening/#file-permissions) . ### Look at the Modified Dates A telltale sign of an infected file is a suspicious modified date. For example, if you haven’t changed a theme’s template in months – and the modified date was last week – that could be a sign of foul play. This can be a bit more difficult to spot in plugins, as they tend to be updated more frequently. But if something doesn’t look right, check out the plugin’s changelog. That can tell you when the last update was. Even if you didn’t update the moment the new version was released, you’ll at least have a time range to look for. ### Open Suspicious Files (Carefully) If you’ve found some suspicious-looking files, you may want to open them and inspect their code. Before doing that, it may be a good idea to run them through a malware scanner – just to be safe. Malicious code seems to stick out like a sore thumb, yet the eyeball test alone may not be enough to be sure. In this case, you can grab another copy of the file – one that’s known to be clean – and compare. If you spot any differences, you’ll know something is up. ### Search the Web The WordPress.org support forums can be a great place to gather intelligence. If you suspect a specific plugin or even WordPress core, odds are other users have experienced something similar. You may just find that you’re not alone in your suffering. In addition, the [WPScan Vulnerability Database](https://wpscan.com/) offers a laundry-list of core, plugin and theme security info. It’s a great place to look for known issues. ![Computer code.](https://speckyboy.com/wp-content/uploads/2020/05/wordpress-site-hacked-03.jpg) ## Contact Your Web Host There’s no guarantee that your web host could have prevented a particular hack. But even so, it’s worth reaching out to them in these situations. This is especially so if you aren’t quite sure of the culprit. And, it’s just plain good practice if you’re on a shared hosting account, as it may affect other users (or other sites you’re hosting). If you’re unable to pinpoint a specific vulnerability that led to the hack, your host can be a great resource. They may have seen other customers with similar issues, or it may set off a red flag that leads to a security hole being patched. In addition, some hosts also offer security scans and malware cleanup. While they’ll likely cost you a bit of cash, it might help you stamp out a recurring problem. Just make sure to ask about any warranties and find out what’s covered before making the investment. ![A man talking on a cell phone.](https://speckyboy.com/wp-content/uploads/2020/05/wordpress-site-hacked-04.jpg) ## Take Note of Lessons Learned When it’s all said and done, there’s a good chance that you’ve learned a thing or two about WordPress security. That’s good news, because you can apply this new knowledge towards keeping your website safe. For example, recovering from a hacked website could lead to using stronger passwords or updating software more frequently. You might even implement measures such as [two-factor authentication](https://speckyboy.com/two-factor-authentication-wordpress/) . It may also make you aware of server settings that can make it more difficult for a malicious actor to do damage. The point is to stiffen security to the point where you can at least fend off the most common sorts of attacks. Beyond that, it’s about staying vigilant and never taking security for granted. ## Related Articles - [How to Hide WordPress Blocks Based on Device](https://speckyboy.com/how-to-hide-wordpress-blocks-based-on-device/) WordPress 7.0 adds responsive Block Visibility controls for the Block Editor. Learn how to create separate desktop and mobile blocks, hide each one by device, and test the result. - [How To Make Your WordPress Website AI-Friendly](https://speckyboy.com/wordpress-website-ai-friendly/) AI search is changing how people reach websites. This article shows how to make WordPress more AEO friendly with robots.txt, sitemaps, agent readiness checks, Markdown output, and helpful resources. - [Best WordPress Staging Site Tools & Resources in 2026](https://speckyboy.com/wordpress-staging-site/) A WordPress staging site gives you a safe place to test updates, new plugins, custom code, and AI tools before touching production. Learn hosting, local, and plugin-based options. - [Quick Tip: How To Use WordPress Block Notes](https://speckyboy.com/wordpress-block-notes/) WordPress Notes adds block level comments to the Block Editor. We show you how to add a note to any block, reply in a thread, get email notifications, and mark notes as resolved for smoother collaboration. - [A New Choice: Use an Existing Plugin or Vibe Code Your Own?](https://speckyboy.com/existing-plugin-or-code-your-own/) AI makes it easier to build custom WordPress plugins, but it does not make the decision automatic. This article breaks down when to install an existing plugin and when to build your own, based on scope, flexibility, and long-term maintenance. ## Related Topics - [Learn WordPress](https://speckyboy.com/topic/learn-wordpress/) ## Written by Eric Karkovack Eric Karkovack is a web designer and WordPress expert with over two decades of experience. You can visit his business site [here](https://www.karks.com/) . He recently started a writing service for WordPress products: [WP Product Writeup](https://wpproductwriteup.com/) . He also has an opinion on just about every subject. You can follow his rants on Bluesky [@karks.com](https://bsky.app/profile/karks.com) . [Read more articles by Eric Karkovack](https://speckyboy.com/author/erickarkovack/) --- Top This page may contain affiliate links. At no extra cost to you, we may earn a commission from any purchase via the links on our site. You can [read our Disclosure Policy](https://speckyboy.com/affiliate-disclosure/) at any time.