At a glance: The first half hour after a WordPress hack is about containing damage: document symptoms, back up the site’s current state, reset administrator passwords, and notify the hosting provider. Malicious code is then removed and the vulnerability used by the attacker is closed. Cleanup without closing that vulnerability can lead to rapid reinfection. In emergencies, an initial response is scheduled for the same day.
A hacked WordPress site is usually noticed through one symptom: visitors are redirected, unfamiliar pages appear in Google results, or the hosting provider suspends the account. WordPress hacked site recovery goes beyond removing that symptom; unless the attacker’s entry point is found and closed, the cleaned site can quickly become infected again. Taking the right first steps when your WordPress site is hacked limits both data loss and damage to search visibility.
This page explains the steps for the first 30 minutes, what hacking symptoms mean, the cleanup stages, how Google warnings are removed, and measures to prevent another attack. It draws on WordPress.org’s security documentation and Google Search Console help resources. Based in Maltepe Gülsuyu, Onur Freelance provides hack cleanup and WordPress security services across Istanbul and remotely for sites elsewhere.
Video transcript
What should you do if your WordPress site is hacked? The first goal is to contain the damage; malicious code is then removed and the attacker’s entry point closed. In the first half hour, document symptoms, back up the infected site, and reset administrator passwords. Notify the hosting provider and check the Security issues report in Search Console. Symptoms include conditional redirects, Japanese spam pages, Chrome’s Dangerous site warning, unfamiliar administrator accounts, and suspended hosting accounts. Files are scanned for obfuscated code, and the core and plugins are reinstalled from official sources. The database is checked individually, and the site is verified again as Googlebot sees it. After cleanup, a review request is used to remove Google’s warning; this can take a few days to a few weeks. Credentials are renewed, two-step verification is enabled, and regular backups are configured. The page includes a credential renewal checklist, protection layers, and pricing. In emergencies, an initial response is scheduled for the same day; contact us through WhatsApp. Onur Freelance dot com.
Let’s review your hacked site together
Send the symptom, any Google or hosting notification, and the website address through WhatsApp for an initial assessment. In emergencies, an initial response is scheduled for the same day.
Hacked WordPress site recovery at Onur Freelance: key details
- Price: WordPress hack cleanup costs 3,000 to 10,000 TL depending on the situation; single sites with a clean backup and infection limited to a few files are closer to the lower end.
- Time: In emergencies, an initial response is scheduled for the same day.
- Scope: Initial review, identifying the entry point, file and database cleanup, credential renewal, hardening, and preparing Google’s Security issues review request.
- Team: Founder Onur Ertem, with over 8 years of experience in web design and digital marketing, and two digital marketing specialists. Discussions take place directly with the team doing the work, without an intermediary account representative.
- Location: Maltepe (Gülsuyu), Istanbul. Work is performed remotely; face-to-face meetings in Istanbul are available by appointment.
- Google reviews: A 5.0 rating on Google Business Profile from 217 reviews.
My WordPress site is hacked: what should I do in the first 30 minutes?
The first half hour is about containing damage and preserving evidence. Immediately deleting files or rushing to rebuild the site can destroy clues to the attack’s origin. The following sequence aligns with WordPress.org’s guide for hacked sites.
- Document the symptoms: Record screenshots and URLs of redirects, warning screens, or unfamiliar pages. Note recently installed plugins, theme changes, or updates.
- Back up the current state: Copy files and the database to a separate location in their infected state. Keep this copy for investigation, rather than restoration.
- Reset administrator passwords: Renew passwords, especially for all administrators, and check the user list for unfamiliar accounts.
- Notify the hosting provider: On shared servers, the problem may have spread to other accounts; the provider can share access logs and information about its own measures.
- Scan the computer used to access the site: WordPress.org notes that infections sometimes start on the owner’s computer through malware that steals FTP or dashboard passwords.
- Check Search Console: Look in the Security issues report for problems Google has detected and example URLs.
Signs of a hacked WordPress site and what they mean
A hacked WordPress site does not always look broken; some attacks show different content only to Google, mobile visitors, or logged-out users. A normal appearance in the owner’s browser therefore does not prove the site is clean. Common symptoms and their usual implications are:
| Symptom | What does it usually indicate? |
|---|---|
| Visitors arriving from Google or mobile devices are redirected elsewhere | Conditional redirect code added to .htaccess, theme files, or the database |
| Japanese, pharmaceutical, or counterfeit product pages in a site: search | A hack generating spam pages, often in randomly named folders |
| A “This site may be hacked” notice in search results | Google has detected altered pages or added spam pages |
| A red “Dangerous site” warning in Chrome | Google Safe Browsing has flagged malware or deceptive content |
| An unfamiliar administrator account in the user list | An account created by the attacker for persistent access |
| An unfamiliar new owner notification in Search Console | The attacker has verified ownership to manage sitemaps and settings |
| The hosting account is suspended or emails land in spam | Malicious files are running on the server or the site is being used to send bulk spam email |
| The administrator password suddenly stops working | Account takeover; the database needs to be checked |
Sudden slowness or login problems can also result from a plugin conflict. Errors and conflicts without signs of a hack are handled separately through WordPress troubleshooting.
Google warnings and the Search Console Security issues report
When Google detects that a site has been hacked or behaves in ways that could harm visitors, it lists its findings in Search Console’s Security issues report. Affected pages may carry warning labels in search results, or visitors may see a browser warning before opening a page.
Four hacking categories stand out in the report: Hacked: Malware, Code injection, URL injection, and Content injection. Code injection adds code that redirects to a malicious site or runs secretly in the browser. URL injection creates new spam pages, while content injection adds hidden links or text to existing pages. Google’s Security issues report help page explains how to verify each type.
The Japanese keyword hack is a well-known example. According to Google’s web.dev guide, it creates automatically generated Japanese pages in randomly named folders, and attackers often add themselves as property owners in Search Console. These pages may show the owner a 404 error while serving spam to Google, so checks use the URL Inspection tool to view what Googlebot sees.
Page contents
Why are WordPress sites hacked?
WordPress hacks usually originate in the software running on the site rather than the server. WordPress.org’s hardening documentation also notes that attacks more often originate at the application layer than in the infrastructure. Common entry points include:
- Outdated plugins and themes: A version with a published vulnerability is an easy target for automated scanning bots.
- Unlicensed (nulled) themes and plugins: Cracked copies distributed for free may contain backdoors or hidden redirects.
- Weak or reused passwords: Administrator, FTP, and hosting dashboard passwords can be compromised through brute-force attempts or other data breaches.
- An infected computer: Malware on the owner’s device can send saved FTP or dashboard passwords to an attacker.
- Cross-infection on shared hosting: An infected, unmaintained site in the same account can spread malicious code to other folders.
- Unused plugins that have not been deleted: Inactive plugin files can remain vulnerable while they are on the server.
Cleanup without closing the entry point allows the same attacker to return through the same route.
Hacked WordPress site recovery step by step
Recovery consists of backups, scanning, clean reinstallation, database cleanup, and verification. A clean backup from before the hack shortens the process, but a restored backup still contains the vulnerability.
- Investigation copy: A full backup of the infected site is stored separately; modified file dates and server access logs are reviewed.
- File scanning: Theme, plugin, and uploads folders are scanned for obfuscated code such as base64 or eval, PHP files that should not run in uploads, files added to mu-plugins, and .htaccess changes. Remote and server-side scanning are combined; WordPress.org also notes that one scanner is insufficient.
- Core reinstallation: The wp-admin and wp-includes folders are reinstalled from official sources using the site’s existing version, followed by an update to the latest version.
- Clean plugin and theme copies: Each plugin and theme is reinstalled from its official source, unused items are fully removed, and unlicensed copies are replaced with licensed versions.
- Database cleanup: Scripts and hidden links in posts and pages, changed site URLs and autoloaded values in the options table, scheduled tasks, and the users table are checked individually.
- Spam page removal: Pages created by the attacker are deleted, and their URLs are verified to return 404 or 410 responses.
- Verification: The site is checked again on desktop and mobile, and as Googlebot sees it through Search Console’s URL Inspection tool.
If customer data was affected: KVKK (Turkey’s Personal Data Protection Law) notification
Sites with WooCommerce stores, membership systems, or saved form submissions require a separate assessment of whether the attacker accessed personal data. Under Personal Data Protection Board Decision 2019/10, the data controller must notify the Board without delay and within 72 hours of learning of the breach, under KVKK (Turkey’s Personal Data Protection Law). Details appear in the KVKK data breach notification announcement. Technical findings inform this assessment; legal advice is recommended for the notification decision.
Password, key, and access renewal checklist
After cleanup, passwords and keys for every access point should be renewed. WordPress.org recommends changing passwords again after the site is clean, because attackers may still have access during the initial password change.
| Access point | Required action |
|---|---|
| WordPress users | Remove unfamiliar administrators, renew all administrator passwords, and reduce unnecessary permissions |
| wp-config.php security keys (salts) | Generate new keys to end all active sessions. Check plugins that store key-dependent data beforehand |
| Database user | Change the password and update it in wp-config.php |
| FTP / SFTP accounts | Renew passwords and close unused accounts |
| Hosting dashboard and domain account | Renew the password and enable two-step verification where available |
| Search Console and Analytics | Remove unfamiliar owners and users |
| Payment, SMTP, and API keys | Renew integration keys stored on the site through the relevant services |
Security keys do not need routine replacement; this is done after a confirmed hack to invalidate old sessions.
Let’s start cleanup at the root cause
Once site and hosting access is shared securely, the entry point is investigated before file and database cleanup begins. The scope is finalized after the initial review.
How is Google’s hacked site warning removed?
After complete cleanup, a review request is submitted through Search Console’s Security issues report to remove the warning. Google requires all reported issues to be fixed across all pages and the fixes explained in the request; requests with incomplete cleanup are rejected.
According to Google’s help page, a review can take a few days to a few weeks. Email notifications confirm receipt and completion; the same request should not be resubmitted before a decision. Chrome’s warning status can also be checked with the Google Safe Browsing site status tool.
Even after the warning is removed, attacker-created spam URLs can remain indexed for a while. They must return 404 or 410, be absent from the sitemap, and any attacker-added sitemaps must be removed from Search Console. Prolonged indexing and crawling problems are followed up separately through technical SEO services.
Preventing another hack: lasting layers of protection
Prevention rests on updated software, a small number of trusted plugins, strong authentication, and tested backups. WordPress.org’s WordPress hardening guide describes security as risk reduction rather than complete protection and explains measures in layers.
- Regular updates: Keep the core, plugins, and themes current; WordPress has supported automatic updates since version 3.7.
- Licensed sources only: The backdoor risks of nulled themes and plugins are also discussed in the article on choosing an e-commerce script.
- Two-step verification: Add a second verification step to administrator account passwords.
- Disable dashboard file editing: Adding DISALLOW_FILE_EDIT to wp-config.php prevents editing theme and plugin files through the dashboard even if it is compromised.
- File permissions: Protect folders with 755 permissions, files with 644, and wp-config.php with 400 or 440 where possible.
- Off-site backups: Regular, complete backups stored off the server allow restoration to a pre-infection state when a hack is detected late.
- Web application firewall (WAF): Filter malicious requests before they reach the server and limit login attempts.
Most of these measures require ongoing work. Regular updates, backup checks, and security monitoring can be provided through the annual WordPress maintenance and updates service.
The difference between surface cleanup and root cause recovery
Hack cleanup often amounts to installing a security plugin and deleting the files it finds. This can remove visible symptoms while missing code embedded in the database, a hidden mu-plugins file, or an additional administrator account created by the attacker.
A root cause approach first asks how the attacker got in. Access logs, file modification dates, and plugin versions are compared to identify the entry point, and cleanup is planned around that finding. The core and plugins are reinstalled from clean sources rather than patched, and Google records are addressed as part of cleanup.
After recovery, the owner receives details of the entry point and measures taken, alongside confirmation of cleanup.
When is professional WordPress hack cleanup support needed?
Owners can perform cleanup themselves if a clean backup exists, the vulnerability is known, and they are comfortable working with files and databases. Google also notes that repairing hacked sites requires understanding code and server configuration, and recommends support for those who are not comfortable with this work.
Professional support is a safer choice without a clean backup, when redirects return after cleanup, when hosting is suspended, or when payment and customer data are involved. If the provider has closed the infected account, the clean site may need migration to a new server. In that case, WordPress website migration is planned alongside cleanup.
WordPress hack cleanup pricing: 3,000–10,000 TL
At Onur Freelance, WordPress hack cleanup costs 3,000 to 10,000 TL depending on the situation. Single sites with clean backups and infection limited to a few files fall toward the lower end. Costs approach the upper end when malicious code has spread into the database, many spam pages are indexed, several sites in one hosting account are affected, or a sensitive system such as WooCommerce is involved.
The initial review is free. The final amount is shared in writing after reviewing the site and before cleanup starts. Optional ongoing WordPress maintenance after cleanup costs 500–2,000 TL per month.
Service scope, process, and pricing factors
Onur Freelance’s hacked WordPress site recovery covers initial review, entry point identification, file and database cleanup, credential renewal, hardening, and preparing Google’s review request. Work is remote, with face-to-face meetings available in Istanbul on request.
How does the process work?
After you share symptoms and the site address through WhatsApp or by phone, an initial assessment is made; in emergencies, an initial response is scheduled for the same day. Once credentials are shared securely, an investigation backup is taken, findings are shared with the owner, and cleanup follows the approved scope.
What determines the price?
Pricing ranges from 3,000 to 10,000 TL depending on the situation. Because each hack differs in depth, the final amount is provided in a written quote after reviewing the scope. Key factors include:
- Whether a clean, usable backup exists
- Whether the infection affects only files or also the database
- The number of sites in the same hosting account
- Whether the site includes WooCommerce, membership, or multilingual features
- Google warnings and the number of indexed spam pages
- Whether additional migration, speed improvements, or maintenance are required
The site may remain slow after cleanup because of loads left by spam code or damaged caching settings. In that case, speed optimization and performance improvement is assessed separately.
Let’s bring your site back online safely
Contact the same number to ask whether a symptom indicates a hack or to start cleanup. The scope and quote are shared after the initial review.
Related guides
- How to tell if your site has been hacked
- WordPress malware scanning and removal
- When your site redirects to another website
- WordPress security: protection layer by layer
- How to back up WordPress
- Annual WordPress maintenance and updates
- How to fix a WordPress critical error
- Error establishing a database connection
- When you cannot log in to the WordPress admin dashboard
- WordPress specialist in Istanbul
Frequently asked questions
My WordPress site is hacked. What should I do first?
First, document symptoms, make a full backup of the infected site, and reset all administrator passwords. Notify the hosting provider, scan the computer used to access the site, and check Search Console’s Security issues report. Rushing to delete files can destroy evidence of the attack’s origin.
Why does my site redirect visitors arriving from Google?
This usually results from conditional redirect code added to .htaccess, theme files, or the database. Because it often redirects only search engine or mobile visitors, owners may not see the problem in their own browsers.
How is Google's "This site may be hacked" warning removed?
After complete cleanup, submit a review request through Search Console’s Security issues report. Google says reviews can take a few days to a few weeks, and the warning is removed once the fix is confirmed.
Can a hacked site affect SEO rankings?
Yes. Google tries to exclude hacked content from results, may label affected pages with warnings, and Chrome may display a warning screen. Earlier cleanup and review requests help shorten these effects.
How did Japanese spam pages appear on my site?
These pages result from a Japanese keyword hack. Attackers create automated pages in randomly named folders and often add themselves as Search Console property owners; that access must also be removed during cleanup.
Can a cleaned site be hacked again?
Reinfection risk is high if the entry point remains open. Updated core and plugins, licensed sources, two-step verification, disabled dashboard file editing, and regular off-site backups significantly reduce this risk.
How long does hack cleanup take?
Timing depends on clean backup availability, whether infection has spread into the database, and the number of spam pages. An initial response is scheduled for the same day in emergencies; the full scope is clarified after review. Google’s review time is separate.
How is hacked WordPress site recovery priced?
Pricing depends on backups, infection depth, the number of sites in the hosting account, features such as WooCommerce or memberships, and the scope of Google warnings. Costs range from 3,000 to 10,000 TL; a final written quote follows the initial review.
How much does WordPress hack cleanup cost in TL?
At Onur Freelance, WordPress hack cleanup costs 3,000–10,000 TL depending on the situation. Backup availability, database infection, spam page count, and the number of sites in the hosting account determine the amount. The initial review is free, and the final amount is shared in writing before cleanup.
