My website has been hacked: what now?
Calm, ordered steps to clean up and close the hole.
- Don't panic, and don't delete everything. Evidence helps find how they got in.
- Change passwords: client area, cPanel, FTP, database and every admin account on the site.
- Take a copy of the site as it is now, for investigation.
- Restore a clean backup from before the hack, if you have one, then update everything immediately.
- No clean backup? Reinstall the CMS core, replace themes and plugins with fresh copies, and look for unknown files and admin users.
- Find the cause, usually an outdated plugin or a stolen password, and fix it, or it will happen again.
- Check search engines: if Google flagged your site, request a review in Search Console after cleaning.
Need help? Open a ticket to the WordPress department, or the relevant hosting department. Our full hacked website checklist has more detail.