WordPress Site Hacked? 5 First Steps Before You Lose Data

The first thing to do when your WordPress site is hacked is take a full backup of the infected site before you change anything. A hacked WordPress site is a site where an attacker has gained access and added, changed, or hidden files, users, or content without your permission. The infected copy is evidence. You need it.

Most owners do the opposite. They see strange text on the homepage, panic, and start deleting files. That destroys the only record of how the attacker got in. This problem happens when people treat a hack like a mess to clean instead of a break-in to investigate. The damage is rarely the part you can see. Behind the visible spam sits a hidden entry point, and if you delete the evidence, you lose the one thing that tells you where that entry point is.

Sucuri's 2023 Hacked Website and Malware Threat Report found that 49.21% of compromised websites contained at least one backdoor. That means almost half of all cleaned sites still had a hidden door left open. Sucuri also found that 95.5% of all detected infections were on WordPress. This guide covers the five things to do first, the three things that make it worse, why your site was targeted, and how a real cleanup closes the door instead of just wiping the floor.

What Does It Mean When Your WordPress Site Is Hacked?

A hacked WordPress site is one where someone else has gained write access to your files, your database, or your admin panel. They use that access to make money. Sometimes they sell fake products through pages hidden on your domain. Sometimes they inject links to other sites. Sometimes they steal customer data.

The attacker almost never wants you to notice. A defaced homepage is loud and rare. The common hack is quiet. Your site looks normal to you while it shows spam pages to Google and redirects visitors arriving from search. He or she makes money for weeks while your traffic slowly dies.

They get in through software, not through skill. Patchstack's State of WordPress Security in 2026 report recorded 11,334 new WordPress vulnerabilities disclosed during 2025, a 42% rise on the previous year, with 91% of them coming from plugins. Attackers scan the whole internet for sites running the vulnerable version. Your site was found by a script, not chosen by a person.

How Do You Confirm the Hack Before You Touch Anything?

Confirm the hack by checking what other systems see, not what your browser shows you. Your own browser lies to you, because attackers often hide the infection from logged-in administrators.

Open Google and search site:yourdomain.com. Look for pages you never created. Then open Google Search Console and check the Security Issues report, which tells you directly if Google has found a problem. Load your homepage in a private window with no login session. Then load it again from a phone on mobile data.

Look for the specific signs that point to specific problems. If you cannot reach your dashboard at all, you may be locked out of wp-admin rather than simply locked out by a password. If your homepage shows content you never wrote, your homepage has been defaced. If your user list shows admin users you do not recognise, the attacker has built themselves a permanent way back in. And if your browser shows Not Secure but nothing else looks wrong, you may have a certificate problem rather than a hack.

What Are the First 5 Things to Do Before You Lose Data?

The first five things to do are back up the infected site, change every password, put the site in maintenance mode, check Google Search Console, and write down what you see. Do them in that order. Each one protects something the next step could destroy.

1. Take a Full Backup of the Infected Site

Take a complete copy of the files and the database exactly as they are right now, infected and all. Label it clearly so nobody restores it by accident.

The specialist needs this copy to find the entry point. Timestamps on modified files show when the attacker arrived. The injected code itself often names the plugin that was exploited. Delete it and that trail is gone forever.

Store this backup somewhere separate from your hosting account. If the attacker still has server access, a backup sitting on the same server is not safe.

2. Change Every Password and Force a Logout

Change the passwords for WordPress admin, hosting control panel, FTP or SFTP, and the database user. Change the email account those passwords reset to. Then force every logged-in session to end.

Changing passwords alone does not remove an attacker. They keep access through the backdoor file. But it stops the easy route back in while you work, and it stops a second attacker piggybacking on stolen credentials that are being resold.

Use a different password for each one. Reused passwords are how one small breach turns into four.

3. Put the Site in Maintenance Mode, Not Offline

Show visitors a simple maintenance page rather than taking the site fully offline. Keep the server responding.

This matters more than it sounds. A site that returns a dead error for days tells Google the pages are gone. A maintenance page tells Google to come back later. The difference shows up in your rankings weeks after the cleanup is finished.

Customers struggle with this decision because their instinct is to pull the plug. Pulling the plug protects nobody. The infection is already served; the harm is already done. A holding page protects your search position while you fix it.

4. Check Google Search Console for Security Issues

Open Google Search Console and read the Security Issues report before you clean anything. Google often detects an infection before the owner does, and it names which URLs are affected.

This tells you the size of the problem in one screen. If Google has flagged your site, you now have two jobs instead of one: clean the site, and get the warning removed. The second job has its own timeline that you do not control.

If you have never verified your site in Search Console, do it now. It is free, and it is the only place Google tells you what it found.

5. Write Down What You See Before It Changes

Write down and screenshot everything unusual before you touch it. The date and time you noticed. The exact strange text. The URLs that misbehave. Any admin user you do not recognise.

Attacker code often changes itself. Some infections rewrite their own files daily to avoid scanners. What you see this morning may not exist by tonight, and your notes may be the only record.

If you are running a shop, this record matters even more, because a WooCommerce store holds customer data and your response duties are different.

What Should You Never Do in the First Hour?

Never delete files at random, never restore an old backup straight away, and never reinstall WordPress over the top. All three feel productive. All three make the cleanup harder and more expensive.

1. Do Not Delete Files at Random

Deleting files you do not recognise usually breaks the site without removing the infection. Modern WordPress malware hides inside legitimate files rather than sitting in obvious new ones.

The specialist compares your files against clean official copies to find what changed. Random deletion destroys that comparison. You end up with a broken site that is still infected, which is the worst of both outcomes.

2. Do Not Restore an Old Backup Straight Away

Restoring last month's backup hides the problem instead of solving it. Your site looks fine for a few days, then the infection returns.

This problem happens when the backup already contains the backdoor. Attackers commonly sit quietly on a site for weeks before doing anything visible, so the "clean" backup from before you noticed is often already infected. Worse, restoring wipes out the evidence and any real content you published since.

Restore only after someone has confirmed which backup is genuinely clean.

3. Do Not Reinstall WordPress Over the Top

Reinstalling WordPress replaces core files only. It does not touch your plugins, your themes, your uploads folder, or your database, and that is where most infections live.

Sucuri found that 55% of database-infected sites had malicious admin users sitting in the database. A core reinstall leaves every one of them in place. You have done real work and changed nothing.

Why Did Your WordPress Site Get Hacked?

Your site was hacked because software on it had a known weakness that an automated scanner found. It was not personal. Understanding the cause matters because the cause is what you have to close.

1. An Outdated Plugin or Theme

An out-of-date plugin is the most common way in. Sucuri found that 39.1% of content management systems were outdated at the point of infection.

Speed is the problem. Patchstack reports a median time to mass exploitation of just 5 hours for heavily targeted vulnerabilities. Once a weakness is public, attackers reach vulnerable sites the same working day. A monthly update schedule is not fast enough on its own.

2. A Weak or Reused Admin Password

Attackers run millions of login attempts using passwords leaked from other services. If your WordPress password matches one you used on a site that was breached years ago, they walk in through the front door.

No cleanup fixes this. Only changing the password and adding login protection does.

3. A Backdoor Left From an Earlier Hack

If your site was cleaned before and got infected again, the first cleanup probably missed the backdoor. This is the most frustrating cause, and it is common enough that it deserves its own explanation of why the malware comes back.

4. Shared Hosting Cross-Contamination

On cheap shared hosting, one infected site can reach its neighbours. Your own site may have been perfectly maintained and still get infected through the account next door.

Patchstack found that hosting defences blocked only 12% of WordPress-specific vulnerability attacks. Your host is not protecting you as much as you think.

How Does a Professional WordPress Cleanup Work?

A professional cleanup works in three stages: clean the infection, close the entry point that allowed it, then keep it clean. Skipping the middle stage is why so many cleanups fail.

The system works by comparing every file on your site against known clean versions, then examining what is left. Files that do not belong get removed. Files that were modified get restored. The database is checked separately for injected content, rogue users, and scheduled tasks the attacker created.

Then comes the part that a scanner cannot do. The specialist reads the server logs, finds the request that started the infection, and identifies exactly which plugin, theme, or credential was used. That is the entry point. Closing it is what makes the fix permanent.

How Do You Make Sure the Hack Does Not Come Back?

You stop the hack returning by closing the entry point and watching the site afterwards, not by scanning it once and hoping. Removal and prevention are two different jobs.

Cleaning alone removes what you can see. Entry-point closure removes what let it in. A site that has been cleaned but not hardened is exactly as vulnerable as it was the day before the attack, and attackers keep lists of previously compromised sites to revisit.

Ongoing monitoring closes the gap between infection and discovery. Most damage in a WordPress hack comes from the weeks it runs undetected, not from the hack itself. Your rankings fall, your ads get suspended, and your customers see warnings, all before you notice anything is wrong.

How Much Does WordPress Hack Recovery Cost in Dubai?

The cost of WordPress hack recovery depends on how long the infection has been running, how many sites are affected, and whether Google has already flagged the domain. There is no single figure, and anyone quoting one before looking at your site is guessing.

Three things drive the price. The first is scope: a single site caught within days costs far less than a multi-site hosting account infected for months. The second is Google involvement: if a warning is already showing, the work includes review requests and a waiting period. The third is whether you need the site cleaned once or kept clean.

That last point splits the engagement into two modes. A one-off cleanup fixes the incident. Ongoing monitoring is a separate arrangement that watches the site afterwards. Most business sites that have been hacked once need both, because the first hack proved the site is reachable.

The honest way to price this is to look first. A free security check tells you what is actually on the site, which is the only basis for a real number.

Before you compare quotes, what website security covers lists every layer a proper hack recovery job should account for, and the benefits of WordPress security services shows what that work returns.

WordPress Hack Recovery in Dubai by Mohammad Emmon

How Mohammad Emmon Handles a Hacked WordPress Site

Mohammad Emmon cleans the infection and then closes the entry point that caused it, so the site stays clean. Most cleanups fail because the second step never happens. The visible malware gets removed, the hidden backdoor stays, and the site is reinfected within weeks.

He works the other way round. The cleanup removes what is there. The investigation finds how it arrived. The hardening closes that route, and optional monitoring watches for the next attempt. That is the difference between a scrub and a fix.

Emmon has worked in WordPress security since 2021 and reports having secured more than 15,000 websites, a figure from his own records rather than an independent audit. He will also tell you when your problem is smaller than you feared, which happens more often than most site owners expect.

The full scope of his hack recovery work sits on his professional WordPress malware removal page, so cleanup, entry-point closure, and hardening are one job rather than three.

Dubai Business and Hospitality Site Coverage

Emmon works with businesses across Dubai and the wider UAE, with particular focus on hospitality and restaurant websites where a Google warning directly costs bookings. Work is delivered remotely, so there is no wait for an on-site visit.

The UAE Cyber Security Council and CPX reported in the State of the UAE Cybersecurity Report 2025 that over 223,800 assets hosted in the UAE are potentially exposed to cyberattacks, with misconfiguration accounting for 32% of incidents. Local businesses are not a low-risk target, and a hacked booking page costs revenue the same day.

Businesses elsewhere are welcome too. A hacked WordPress site behaves the same whether it is hosted in Dubai, London, or Toronto.

Clients across the Emirates find the local detail on his pages for WordPress security for Dubai businesses and WordPress security for Abu Dhabi companies, and the full picture on his WordPress security expert in the UAE page.

Get a Free Security Check from Mohammad Emmon

The free security check tells you what is on your site right now, before any money changes hands. You get a straight answer about whether you have been hacked, how far it has spread, and what closing it properly involves. Reach out by WhatsApp or book a call, and send the site URL. Contact Mohammad Emmon today for a free security check and find out exactly what is on your site before the damage spreads further.