Your WordPress Site Got Hacked — Here's What to Do Right Now (and Why It'll Happen Again)

Your business website just got hacked. Maybe you saw the "Deceptive site ahead" warning in Chrome. Maybe a customer told you they got redirected to a spam site. Maybe you just noticed a bunch of admin accounts you didn't create.

Take a breath. This is fixable. But there's something nobody in the WordPress ecosystem wants to tell you about what comes next.

If you've been hacked, do this right now

Before anything else, limit the damage. These steps apply whether you're handling this yourself or waiting for a professional.

Put your site in maintenance mode. Most hosting dashboards have a one-click option for this. If not, your hosting provider's support team can help. The goal is to stop serving compromised pages to your visitors and to Google's crawlers. Every hour your hacked site stays live, the SEO damage compounds.

Change every password. WordPress admin, hosting control panel, FTP/SFTP, and your database credentials in wp-config.php. If the attacker created admin accounts, they likely harvested your existing credentials too. Change them all, and enable two-factor authentication on every account that supports it.

Back up the infected site before you touch it. This sounds counterintuitive, but you need a snapshot of the compromised state. If something goes wrong during cleanup, or if a security professional needs to analyze the breach later, you'll want this copy.

Scan for malware. Use your hosting provider's built-in scanner if they offer one, or run a scan through a tool like Sucuri SiteCheck. You're looking for injected scripts in your theme files, suspicious PHP in the uploads directory, and modified core WordPress files. Pay special attention to wp-config.php, functions.php, and any file with base64_decode or eval() calls.

Reinstall WordPress core, themes, and plugins from clean sources. Download fresh copies from WordPress.org and your theme/plugin vendors. Don't just "update" — replace the files entirely. Attackers embed backdoors in legitimate files, and an update won't overwrite the injected code.

Clean the database. Search your wp_posts and wp_options tables for injected scripts, spam links, and iframe tags. Look for unfamiliar entries in wp_users — rogue admin accounts are one of the most common persistence mechanisms.

Request a review from Google. If your site was flagged in Search Console, submit a review request once cleanup is complete. Google typically processes these within 72 hours, but your rankings may take weeks to recover.

Why cleanup doesn't actually fix the problem

Here's what the WordPress security industry doesn't want you to think too hard about: you just went through all of that, and there's a very good chance it's going to happen again.

This isn't fear-mongering. It's what the data shows.

The Patchstack State of WordPress Security report, published in February 2026, found that 11,334 new vulnerabilities were discovered in the WordPress ecosystem in 2025 alone. That's a 42% increase over 2024. And the trend is accelerating — by January 2026, security researchers were finding 333 new WordPress vulnerabilities per week.

But the volume isn't even the scariest part. It's the speed. Among heavily exploited vulnerabilities, the median time from public disclosure to active exploitation was five hours. Not five days. Five hours. And 46% of vulnerabilities didn't even have a patch available when they were disclosed — meaning almost half the time, there was literally nothing a site owner could do to prevent exploitation.

Modern WordPress malware is also designed to survive cleanup attempts. The Lock360 malware family, which was the most prevalent variant tracked by Monarx's server-level detection in 2025, uses memory-resident techniques to automatically reinfect files after they've been cleaned. You delete the malware, and it writes itself back. The Parrot TDS system goes further — it serves different content depending on who visits the site. Search engine crawlers see spam pages. Human visitors get redirected to phishing sites. Security scanners and site owners see the normal site. The infection stays invisible until your rankings crater or a customer complains.

Perhaps most concerning: in 14% of infected sites studied, the malware had specifically tampered with Wordfence security plugin files to hide itself from detection. The tool designed to protect your site was being subverted by the very malware it was supposed to catch.

The real cost of the WordPress security treadmill

Let's do the math that most WordPress agencies would prefer you didn't.

A typical small business WordPress site runs 15-20 plugins. Each one is an independent codebase maintained by a different developer with different security practices. The average WordPress maintenance retainer runs $200-500/month, which covers plugin updates, backups, and basic monitoring. Emergency malware cleanup costs $300-1,000 per incident. A quality security plugin subscription adds $99-299/year.

Over three years, that's roughly $10,000-$22,000 in maintenance and security costs — for a site that was probably built for $3,000-$8,000 in the first place. And none of that spending eliminates the underlying risk. It just manages it. You're paying to keep running on a treadmill.

Meanwhile, every hack costs you more than just the cleanup invoice. Google flags your site, and your organic traffic drops. Customers see security warnings and lose trust. Your email deliverability suffers if your domain gets blacklisted. The SEO damage from even a brief compromise can take months to fully recover from.

Why WordPress is architecturally vulnerable

This isn't about WordPress being "bad software." WordPress core is actually reasonably secure — only 2 of those 11,334 vulnerabilities in 2025 were in WordPress core itself. The problem is architectural.

WordPress runs on PHP with a MySQL database behind it. Every page load executes server-side code. Every plugin has full access to your database, your filesystem, and your server's network. There's no sandboxing, no permission system, no isolation between plugins. When one plugin has a vulnerability, the attacker gets access to everything.

91% of all WordPress vulnerabilities in 2025 came from plugins. And you can't run a WordPress site without plugins — they're what make WordPress functional. Your contact form is a plugin. Your SEO tools are plugins. Your caching, your backups, your security monitoring — all plugins. Each one is a potential entry point, and you need a dozen or more just to run a basic business site.

Traditional hosting security doesn't solve this either. Patchstack's pentesting studies found that common hosting defenses — Cloudflare, ModSecurity, Imunify360 — blocked only 12-26% of real WordPress exploits. The majority of WordPress attacks exploit Broken Access Control vulnerabilities that look like normal authenticated traffic to a firewall. The firewall can't tell the difference between a legitimate user and an attacker exploiting a plugin flaw.

There's a different way to build websites

None of these problems exist in static site architectures. When a website is pre-rendered as HTML files and served from a global CDN, there's no database to breach, no server-side code to exploit, no admin panel to brute-force, and no plugins to compromise.

The attack surface drops to effectively zero. Not because the site is "more secure" in some incremental way — but because the things attackers exploit simply don't exist in the architecture.

These aren't experimental technologies. Companies like Nike, TikTok, Hulu, and the Washington Post run on frameworks like Next.js. The tools are mature, the hosting is often cheaper than WordPress hosting, and the performance is dramatically better — sub-second load times are the norm, not the exception.

For a small business, this means you pay once to build it right, and then it just runs. No weekly plugin updates. No maintenance retainer. No 3 AM panic when your hosting provider emails about a compromise. No annual security plugin renewals. No treadmill.

The total cost of ownership over three years is typically 60-70% less than a comparable WordPress site when you factor in ongoing maintenance, security costs, and the hidden cost of downtime and lost trust.

See where your site stands right now

If you're running WordPress — or any platform — and you're not sure how your site scores on speed, security, and SEO, we built a free tool that shows you in 60 seconds.

Run your free website audit →

No email required to see your results. No sales pitch. Just data about your site's performance, security headers, and SEO fundamentals — the same signals Google uses to decide whether to rank you or bury you.

---

Sources cited in this article:

• Patchstack, "State of WordPress Security in 2026" (February 2026) — vulnerability counts, exploitation timelines, hosting defense effectiveness
• Monarx server-level malware detection data (2025) — Lock360 and Parrot TDS malware behavior, published in the Patchstack report
• Sucuri, "2023 Hacked Website & Malware Threat Report" — 95.5% CMS infection share