Signs of a hacked site include unknown admin users, redirects to other sites, spam pages in search results, a browser warning, or a hosting provider suspending the account. Work through the steps in order; skipping straight to "delete the bad files" usually leaves the way back in open.
1. Contain
- Put the site in maintenance mode or take it offline.
- Change the passwords for hosting, control panel, FTP/SFTP, database and CMS admin accounts, from a computer you trust.
- Revoke API keys and tokens stored on the server.
- Tell your host; they may see the source of the attack in their logs.
2. Preserve and investigate
- Take a copy of the hacked site and its logs before changing anything, for investigation.
- Check recently modified files and unknown files in upload folders.
- Review admin users and scheduled tasks for anything you did not create.
- Look at access logs around the time the problem started to find the entry point (an outdated plugin, a stolen password, an upload form).
3. Clean or restore
- Prefer restoring a backup from before the compromise, then updating everything.
- If there is no clean backup, reinstall the CMS core, theme and plugins from official sources and keep only your content and uploads, after checking them.
- Remove any plugin or theme you do not use.
4. Close the hole
- Update the CMS, plugins, themes and server software.
- Fix the entry point you found in step 2.
- Turn on two-factor login for admin accounts.
- Scan the site again after cleaning.
5. Recover trust
- If Google flagged the site, request a review in Search Console after cleaning.
- If the site handled personal or payment data, check your legal duty to notify customers or authorities.
- Watch the site and logs closely for the next few weeks.
Restoring the same backup without fixing the entry point usually leads to the same hack within days.