Most hacked sites I clean were hacked weeks before anyone noticed. The owner finds out from a customer, a Google warning, or a suspended-account email from the host, not from the site itself, because modern infections are built to stay quiet. So the first job is not fixing. It’s knowing. Here are the signs I check, from loud to subtle, and then what to do in the first ten minutes, which is mostly a list of what not to do.
The loud signs
Visitors get redirected. You open the site and land on a pharmacy, a casino, a “your computer is infected” page. Often only on mobile, often only from Google search results, and often not for you, because the malware hides from logged-in admins. Test in a private window on your phone, arriving from a Google search, not by typing the URL.
Google shows a warning. “This site may be hacked” under your result, or a red interstitial in Chrome. Search Console, under Security & Manual Actions, will say exactly what Google found and on which URLs.
Your host suspended the account. Hosts scan for outbound spam and phishing pages. A suspension email usually names the file.
Pages you didn’t write. Japanese or pharmaceutical keywords in your Google results (site:yourdomain.com shows them), thousands of URLs you’ve never seen, or a spike of “pages indexed” in Search Console.
The quiet signs
Admin users you didn’t create. Users → Administrators. Any name you don’t recognise, especially with a Gmail address or a name that mimics yours.
Files changed on a date nothing was updated. Sort wp-content by modified date over FTP. Core files in wp-includes should all share the date of your last WordPress update; a lone file from last Tuesday is suspicious.
Plugins or themes you never installed, often with plausible names (“WP Core Helper”, “SEO Booster”) and no listing on wordpress.org.
Email bounces and spam complaints. The server sends spam under your domain; you find out when your own emails start landing in junk.
A slow site, suddenly. Crypto miners and spam scripts eat CPU. If the host’s resource graph jumped and you changed nothing, look harder.
Ads or popups you didn’t place, sometimes only for visitors from certain countries.
Search Console “Discovered, currently not indexed” spikes, and sitemaps you didn’t submit.
Plain English Two of these together is a hacked site until proven otherwise. One redirect report from a customer is worth more than a clean scan from a free plugin, because the malware was written to pass that scan.
The first ten minutes
The instinct is to start deleting. Resist it. The first ten minutes decide whether the cleanup sticks or the site is reinfected in a week.
- Don’t restore a backup yet. If you don’t know when the infection started, you’ll restore an infected copy, and you’ll destroy the evidence of how they got in. Take a fresh backup of the hacked site first, files and database, and keep it.
- Change the passwords that matter, from a clean device. WordPress admin, hosting panel, FTP/SFTP, and the database (then update
wp-config.php). If a password was reused elsewhere, change it there too. - Check the administrators list and remove any you didn’t create. Note the usernames and creation dates before you delete them.
- Put the site in maintenance mode if it’s redirecting visitors or serving phishing pages. A five-line
index.htmlfrom the host is fine. Losing an afternoon of traffic is cheaper than losing your domain’s reputation. - Turn on logging and download the last two weeks of access logs from the hosting panel. The entry point is in there: a POST request to a plugin file at an odd hour, repeated from one IP.
- Write down what you saw and when. Which URL redirected, what Google said, what date the odd files carry. Whoever cleans the site, you or a professional, needs that timeline.
What not to do Don’t run three “malware removal” plugins and delete whatever they flag. They find the obvious files and miss the backdoor, and the deletions make the timeline unreadable. Don’t email the “developer” from a plugin you don’t recognise. Don’t pay anyone who contacts you about the hack.
What a real cleanup involves
Finding every modified file by comparing against clean copies of core, plugins, and themes (not by scanning for known signatures). Reading the access logs to find the entry point, because a cleanup that doesn’t close the door is a subscription. Checking the database for injected scripts in posts, options, and widgets. Removing the backdoors, which are the small files nobody notices, not the loud redirect. Then patching the vulnerability, rotating every credential, and asking Google to re-review.
That is a few hours of careful work, and most of it is reading, not deleting. If you’d rather hand it over, it’s what the hacked-site cleanup is: same day, fixed price, and a 30-day re-clean guarantee because the door was closed, not just the mess swept.