How to Fix a Hacked Website (Step-by-Step)

You type in your own URL and land on a pharmacy page, or Chrome greets every visitor with a red "deceptive site ahead" screen. Hacks rarely announce themselves politely. They show up as weird redirects, spam pages ranking for keywords you never targeted, or an admin panel with users you did not create. This guide walks through how to confirm the hack, clean it out completely, and get the warning lifted from search results. We also provide emergency website repair and maintenance around the clock, with diagnosis starting at $25 and most fixes completed in 24-48 hours, so this guide comes from the repair bench, not from someone summarizing forum threads.

Key Takeaways

• Confirm the hack first: Unexpected redirects, unknown admin users, spam pages in search results, and browser warnings are the four clearest signals that someone else is inside your site.
• Back up before you delete: A snapshot of the infected site preserves the file timestamps and logs you need to find the entry point.
• Outdated plugins are the usual door: On WordPress, unpatched plugins and themes cause most infections, so updating them is part of the cleanup, not an optional extra.
• Google does not forgive automatically: After the site is clean, you must file a review request to remove the Safe Browsing warning.

The Signs You Have Been Hacked

Not every odd behavior is an attack, but these five symptoms almost always are:

1. Unexpected redirects. Visitors land on your domain and get bounced to gambling, pharma, or fake shopping sites, often only on mobile or only when arriving from Google.
2. Spam pages in the index. Search "site:yourdomain.com" and find pages about casinos or payday loans that you never published.
3. Defacement. The homepage is replaced with a message, a flag, or a hacker group's name.
4. Browser blacklist warnings. Chrome, Firefox, or Safari shows a "deceptive site ahead" interstitial, which means Google Safe Browsing has flagged the domain.
5. Weird admin users. New administrator accounts in WordPress, or scheduled posts you did not write, appearing at 3 a.m.

A slow site or a broken layout is usually a maintenance problem, not an attack. The symptoms above mean someone else controls part of your site, and that changes the playbook completely.

The Recovery Process, Step by Step

Step 1: Snapshot everything before you touch anything

Back up the full site, database included, exactly as it is now. Yes, that means copying the malware too. You need it for two reasons: if the cleanup breaks something, you have a restore point, and the file timestamps in the infected copy are your best evidence for when the attacker got in. Most hosts keep snapshots, but only for a few days, so verify before relying on one.

Step 2: Find the entry point

Ask "how did they get in" before "what did they break." On WordPress, the answer is an outdated plugin or theme in the majority of cases. Compare file modification dates against your snapshot, check access logs for suspicious POST requests around the first infection date, and look for PHP files hiding in the uploads folder. If you remove the malware but leave the entry point open, the site gets reinfected within days and you start over.

Step 3: Scan and remove the malware

Run a real scanner, not a hunch. Wordfence's scan, your host's malware scanner, or ClamAV on the server all work. Work through the results in this order: delete injected files entirely, remove obfuscated code blocks appended to theme files, revoke rogue cron jobs, and restore any core files from a fresh download rather than editing them by hand. If the infection reached the database, clean the spam rows and rogue administrator users directly, then repair and optimize it.

Step 4: Update and patch everything

Update the core, every plugin, every theme, and PHP itself if your host still runs an end-of-life version. Delete plugins and themes you no longer use instead of just deactivating them, because inactive code still gets exploited. This step is where most DIY cleanups fail: people remove the malware, skip the patching, and get reinfected the same week.

Step 5: Rotate every credential

Change every password the site has: WordPress admins, the database password, FTP and SFTP accounts, the hosting control panel, and any API keys. Regenerate the salts and keys in wp-config.php, which invalidates every logged-in session and cookie. Assume the attacker read every secret on the server, because file access usually means they did.

Step 6: Request a review from Google

If Safe Browsing flagged the site, the warning stays until you ask for a recheck. Open Search Console, go to the Security Issues report, confirm every listed issue is fixed, then submit the review request with a short, factual note about what you found and removed. Reviews typically resolve in a few days to two weeks, and every day of warning costs traffic, because most visitors leave when the interstitial appears.

Step 7: Monitor afterwards

The two weeks after a cleanup are the danger zone. Watch file change alerts, review access logs for repeat patterns, and keep daily backups so a reinfection is a restore instead of a second project. Put a firewall in front of the site before calling the job done.

Why WordPress Is the Most Common Target

WordPress powers roughly 40% of the web, which makes it the biggest target by simple arithmetic. The deeper reason is its plugin ecosystem: tens of thousands of plugins, many maintained by one developer in their spare time, many abandoned years ago while still installed on millions of sites. Each one is a door, and attackers scan for unlocked doors in bulk. That is not an argument against WordPress, it is an argument for treating updates as routine hygiene rather than an occasional chore. Most hacked WordPress sites we see were running at least one plugin that had not been updated in over a year.

The Time Cost Reality, and When to Call for Help

An honest cleanup takes hours, not minutes. Scanning alone can run 30-60 minutes, and reviewing results, patching, rotating credentials, and filing the review request adds several more. On a small brochure site with one admin, an evening is realistic if you know what you are doing. On an e-commerce store, every hour of downtime is lost revenue, and the database is bigger.

That is when emergency repair pays for itself. Our emergency website repair team starts work within hours, finishes most fixes in 24-48 hours, and backs every repair with a 30-day warranty, so if the same problem returns in that window, it gets fixed again free. Diagnosis and minor fixes start at $25, with a custom quote per issue and no obligation. If the hack is severe enough that rebuilding is smarter than cleaning, website development services with fixed-price plans from $250 include redesigns that preserve your content and rankings, so you are not starting from zero.

Prevention: Cheaper Than Any Cleanup

Every step above gets cheaper when it never has to happen:

1. Updates on a schedule. Weekly, not "when I remember," with plugins tested in staging first.
2. Daily offsite backups. A backup on the same server as the hack is not a backup.
3. Hardening. Two-factor authentication on every admin account, a firewall, and the removal of unused plugins and themes.
4. Least-privilege admins. Editors get editor roles, not administrator, and contractor accounts get deleted when the project ends.

Hacks also masquerade as SEO problems: spam pages pollute your index and rankings drop, which looks exactly like a penalty. If your traffic does not recover after cleanup, read our guide on recovering from a Google penalty, and run a technical SEO audit checklist to confirm the damage is fully gone.

Your Questions, Answered (FAQ)

How do I check whether my site is actually flagged?

Search "site:yourdomain.com" in Google and look for pages you do not recognize, then open Search Console and check the Security Issues report, which is authoritative for manual flags. For the browser interstitial, Google's Safe Browsing site status checker shows the current flag and its reason. Do all three, because a site can be infected before it is flagged.

Can I clean a hacked website myself?

Yes, if it is a small site, you have full server access, and you can read a scan report without panicking. Budget an evening for a simple infection. Call for professional help when the site takes payments, when the infection survives your first cleanup, or when you cannot find the entry point, because those three situations reward experience.

How long does a hacked website cleanup take?

A careful DIY cleanup runs 4-12 hours of actual work spread over a day or two. Professional cleanup is faster because the diagnosis step is practiced: our emergency repair work begins within hours of your message, and most fixes are completed in 24-48 hours, with the review request filed as soon as the site is verifiably clean.

How much does professional hacked website repair cost?

It depends on severity, and honest providers quote per issue. Our emergency repair starts at $25 for diagnosis and minor fixes, custom quoted once the problem is visible, with a 30-day warranty on the repair work. Market-wide, a full malware cleanup from a competent shop typically runs $100-500 depending on site size, so treat anyone quoting four figures for a five-page site with suspicion.

Will my rankings recover after the hack?

Usually, yes, if the cleanup was complete and the spam pages are removed from the index, but it is not instant. Rankings dip because Google deindexed pages or served the warning to users, and they return as the index refreshes over weeks. If traffic stays depressed two to three months after a clean bill of health, the hack may have triggered a deeper quality issue, and that is a penalty problem, not a malware one.

Who do I contact if my site is hacked right now?

Reach our support team at info@cpatools.pro or on Telegram at @CpaTools_bot, and we will start triage the same day. We accept crypto payments via NowPayments along with standard methods, and we have been in business since 2024, so the 30-day warranty is backed by a company that will still exist when you need it.