Skip to content

Is Your WordPress Site Hacked? What to Do in the First 24 Hours

Strange redirects, a blacklist warning or a login that no longer works: what you do in the first 24 hours decides both the damage and the client relationship.

WP Safer 2 min read

A 24-hour dial showing the response moving from the breach through isolation and restore to a secured state

When a client site shows you “strange redirects”, a “blacklist warning in Google” or an admin login that no longer works, what you do in the first 24 hours decides both how big the damage gets and how much trust you lose. The order below keeps you systematic instead of poking at things in a panic.

Signs of a compromise

  • A “this site contains harmful content” warning in Google Search Console
  • Unknown admin users, or plugin/theme files you did not put there
  • Hidden spam links or redirect code in the page source
  • A sudden, unexplained jump in server resource usage

First things first: isolation

Before taking the site fully offline, put it into maintenance mode if you can and immediately change the passwords of every affected account (FTP, WP admin, database). The goal is to cut off the attacker’s ongoing access.

Restoring from a clean backup

Instead of cleaning infected files one by one, going back to a backup dated before the attack — one you are confident is clean — is usually the fastest and most reliable route. That is why “hacked” is a far more expensive word for a site with no regular, automatic backup routine: with no clean point to return to, cleanup is manual and takes hours.

Rotating passwords and keys

After the restore, renew the WordPress login passwords, the database user password, the WordPress security keys (the salts in wp-config.php) and any API keys. If the attacker captured any of those, restoring the old state simply leaves the door open again.

Talking to the client (the agency side)

Tell the client what happened, when it was noticed, which steps were taken and what changed to prevent a repeat — in plain language, without jargon. Transparency is the most effective way to stop a security incident from turning into lost trust.

Preventing a repeat

The post-incident checklist: the discipline of keeping plugin and theme versions current, strong and unique passwords, removing user accounts nobody needs, and automatic backups at a regular interval (daily or weekly, depending on traffic). Uptime monitoring also helps you catch it early when a site becomes unreachable unexpectedly.

In closing

In a compromise, the biggest loss is usually time. With a clean backup and a clear checklist, the answer to “how long will this take” is minutes rather than hours. For choosing your backup frequency, see our post on incremental versus full backups.