If you find your WordPress site hacked, do not start by deleting files. First write down what you are seeing, take a full backup of the infected site, then change every password that can reach the site: hosting, SFTP, database and every WordPress administrator. After that, clean the site, close the hole the attacker used, and ask Google to review the site if it shows a warning.
This guide is for UAE business owners who have just found spam pages, a redirect, a warning in Chrome or a login they did not create. It covers the first steps in the right order, so you do not make the problem harder to fix.
Signs your WordPress site has been hacked
A hack does not always look like a defaced home page. The WordPress.org guide for hacked sites lists signs such as the site being blacklisted by Google or Bing, the host disabling the site, the site being flagged for malware, visitors’ antivirus software blocking it, and new users being created without your permission.
Other signs we often see on business sites in Dubai and Sharjah:
- Search results for your domain show pages in other languages selling medicines, betting or replica goods.
- Visitors on mobile are sent to another site, while the site looks normal on your own computer.
- Your contact form or mail server suddenly sends spam, and your own emails start bouncing.
- An administrator account you do not recognise appears under Users.
- Files with random names appear in the uploads folder or the site root.
The first hour: what to do, in order
The order matters. If you delete files before you have a copy, you lose the evidence that shows how the attacker got in, and you may delete something the site needs.
| Step | What to do | Why |
|---|---|---|
| 1. Write it down | What you saw, when, and recent changes (new plugin, theme edit, new user) | Gives you and your developer a starting point |
| 2. Back up as-is | Copy all files and the database, even though they are infected | A reference copy if the cleanup breaks something |
| 3. Tell your host | Ask what they see and whether other sites on the account are affected | Hosts can see server logs and may already be acting |
| 4. Change passwords | Hosting panel, SFTP/FTP, database, every WordPress admin | Stops the attacker using stolen logins |
| 5. Log everyone out | Replace the secret keys in wp-config.php | Ends any session the attacker still has open |
| 6. Scan | Run a malware scanner on the site and an antivirus scan on your own computer | Shows what was changed and whether your PC leaked the passwords |
The WordPress.org guide recommends this kind of sequence: document the problem, scan the website, scan your local computer, check with your hosting provider, reset all access and create a backup before cleaning. It points out that infections often start on the site owner’s own computer, where malware captures FTP and admin logins, so change passwords from a device you trust.
Change passwords twice: once when you find the hack, and again after the site is clean. If the attacker left a backdoor, they may have captured the first set of new passwords.
Lock down access
Changing your own password is not enough. Every account that can reach the site needs a new password, including staff and any previous developer. The list below is the minimum:
- Hosting control panel (cPanel, Plesk or your host’s own panel).
- SFTP, FTP and SSH users, plus any SSH keys you do not recognise.
- Database user. If you change it, update the password in
wp-config.phptoo, or the site will go down. - WordPress users: reset all administrators and remove any account you did not create.
- Secret keys and salts in
wp-config.php. WordPress.org explains that replacing them with a new set from the official key generator forces anyone still logged in to log out.
Use long, unique passwords from a password manager and turn on two-factor authentication for administrators. If you are not sure who still has access, our checklist for taking over a website from a previous developer lists every account to check.
If you cannot log in to wp-admin because the attacker changed your account, your host’s database tool (usually phpMyAdmin) lets you change the email on your user so you can use the “Lost your password” link.
Clean the site and close the hole
Cleaning a hacked WordPress site is the hard part, and the right approach depends on what the scan finds. The general method is:
- Restore from a clean backup if you have one from before the hack, then update everything straight away so the same hole cannot be used again.
- Replace WordPress core files. WordPress.org says the
/wp-adminand/wp-includesfolders can be replaced safely with fresh copies of the same WordPress version, uploaded by SFTP rather than with the reinstall button, because hacks often add new files that a reinstall does not remove. - Reinstall plugins and themes from their official sources. Delete any you do not use and any you did not install.
- Check the files attackers like to change:
.htaccess,index.php, and the theme’sheader.php,footer.phpandfunctions.php. - Check the database for injected scripts in posts and options, and for extra administrator users.
- Update WordPress, plugins and themes to the latest versions.
- Change the passwords again now that the site is clean.
The most common way in that we see on small business sites is an outdated or abandoned plugin, or a “nulled” (pirated) premium plugin with hidden code. If you skip finding the cause, the same attack usually comes back within days.
Google warnings, email and customer data
A hack can affect more than the website itself.
Google Search warnings
If Google has flagged the site, open Google Search Console and check the Security issues report. Google’s help page on the Security issues report says you should fix every listed issue on all pages, then select Request Review and explain the problem, what you did and the result. It says a review for a hacked site can take a few days to a few weeks, and that you should not resubmit while a request is pending.
Email blacklisting
Hacked sites are often used to send spam. If your email is hosted on the same server as the website, the server’s IP address can end up on blacklists and your normal business email can stop arriving. Ask your host to check this. Moving email to a separate provider with proper SPF, DKIM and DMARC records reduces the risk; we explain those records in our guide to business email on your own domain.
Customer data
If the site stores customer details (form entries, orders, user accounts), find out whether that data was reached. The UAE has data protection rules for personal data, and free zones such as DIFC and ADGM have their own. Speak to your legal adviser about whether you need to tell anyone; this guide covers the technical side only.
How to stop it happening again
- Keep WordPress, plugins and themes updated, and remove anything you do not use.
- Only install plugins and themes from WordPress.org or the developer’s own site. Never use nulled copies.
- Give each person their own login with the lowest role they need. Remove accounts when people leave.
- Turn on two-factor authentication for administrators.
- Keep automatic daily backups stored away from the hosting account, and test a restore now and then.
- Follow the WordPress.org hardening guide for server and file permission settings.
Most of this is routine maintenance. A site that is updated and backed up every week is much easier to recover than one that has not been touched in a year.
Frequently asked questions
Should I take my hacked site offline?
If the site is sending visitors to harmful pages or spreading malware, putting it in maintenance mode protects your customers while you clean it. Take your backup first so nothing is lost.
Can I just restore last week’s backup?
Only if you are sure the backup is from before the hack. Then update everything and change all passwords straight away, or the attacker can use the same hole again.
Will a security plugin remove the hack for me?
Scanners help you find changed and unknown files, but they do not always find everything, and they do not tell you how the attacker got in. Treat a clean scan as one check, not the end of the job.
How long does Google take to remove the warning?
After you request a review in Search Console, Google says a hacked-site review can take a few days to a few weeks. You get an email when it is done.
If your site has been hacked and you want a WordPress developer to clean it and lock it down, see our WordPress development and support page, or send a short description of what you are seeing through our contact page and we will reply with a fixed quote.
