Secure, lock out, inform
A hack is annoying, but rarely a matter of minutes. The order matters more than speed.
- 01
Secure the current state
A copy of all files and the database, exactly as they are now. Not for restoring, but for analysis: if you delete or reinstall right away, you destroy the traces that lead to the vulnerability.
- 02
Change the credentials
The passwords of all administrators, the hosting control panel, the FTP and SSH accounts and the database. New security keys in wp-config.php log out all sessions.
- 03
Lock unknown accounts
Note down administrators nobody knows and revoke their rights. Deleting comes after the analysis.
- 04
Inform your host
They can see access logs you do not have, and can judge whether other websites in the same hosting plan are affected.
- 05
Think of data protection
If personal data could be affected, the 72-hour deadline for a report starts now.
If the website redirects to other people’s sites, a maintenance mode can make sense until it is cleaned up. That way no more visitors end up on scam pages.
How to recognize a hack
Many attacks are designed to go unnoticed for a long time. Even in large companies, attackers go undetected for a median of 14 days (Mandiant, M-Trends 2026).
Redirects for certain visitors
Anyone arriving from Google on a phone lands on a gambling or scam site. On the office PC everything looks normal.
Unknown administrators
Under “Users” there are accounts nobody created, often with inconspicuous names.
Spam pages in Google
A search for site:your-domain.com shows pages you never created, often with ads in a foreign language.
Notices from your host
Emails about spam being sent, unusually high load or a find by the malware scanner.
Warning in Search Console
Messages under “Security issues”, or the note “This site may be hacked” in the search results.
Unknown files
Unknown plugins, a modified .htaccess, or PHP files in the uploads folder, where only images should be.
How it happens
Almost always through a known vulnerability in an extension. The most attacked vulnerabilities are first exploited a median of five hours after they are published, by programs that scan the internet for vulnerable versions. How big or well known a website is makes no difference.
Stolen or weak passwords are less common. That is why new credentials are always part of it, even if the vulnerability was elsewhere.
- 11,334
- new vulnerabilities in the WordPress ecosystem, 2025Patchstack, 2026
- 91%
- of them in pluginsPatchstack, 2026
- 46%
- with no update available at disclosurePatchstack, 2026
- 39.1%
- of infected installations were outdatedSucuri, Hacked Website Report 2023
What your host does, and what it does not
Hosts such as IONOS, Strato or all-inkl usually only react once they notice something themselves: spam being sent from the hosting plan, conspicuous load or a find by their malware scanner.
- Blocks the hosting plan or individual folders so no more spam goes out
- Sends a notice by email
- Backups in the control panel, going back further or less far depending on the plan
- Cleaning up the website itself
- Closing the vulnerability with updates
- Checking the reporting duty under the GDPR
Restore a backup or clean up?
Fast, but only with a backup from before the break-in.
Everything since the backup is lost, and the old vulnerability is back. Without an update and new credentials, the next break-in follows. Many hacks go unnoticed for weeks; by then the backups are infected too.
Thorough, and at the end the cause is closed.
- Reinstall WordPress, plugins and theme fresh from official sources
- Check the database for unknown administrators and injected code, especially options and post content
- Search the uploads folder for PHP files
- Set new security keys, renew all credentials
- Update everything and document the cause
Almost always means: a backdoor was left behind. Attackers like to set up several hidden ways in. According to Sucuri, almost half of all infected websites had such a backdoor (Sucuri, Hacked Website Report 2023). Only once the cause is found and closed is the case resolved.
Google warning and reporting duty
Removing the Google warning
- 1Clean up the website completely
- 2Request a review in Search Console under “Security issues”
- 3Briefly describe what was found and fixed
- 4Serve spam pages in the index with status 410 or 404
According to Google, the review takes from several days to a few weeks.
Personal data affected?
Inquiries from the contact form, customer accounts or newsletter addresses can be affected. If the risk is likely to be high, the people affected must be informed as well (Art. 34 GDPR). Document your assessment in any case. This is not legal advice; if in doubt, clarify it with your data protection officer.
Prevention: how I handle this with the Doppelgänger
The most effective precaution is unspectacular: apply updates quickly but tested, few and well-maintained plugins, monitoring that notices changes, and a way back to a clean state.
That is exactly what I take care of with The Doppelgänger for WordPress: an exact copy of your website on a server of its own in Germany. Even then the risk is not zero, but weeks become hours.
Tested updates, fast
Every update runs on an exact copy of your website first. After testing, security updates usually go live within 24 to 48 hours.
File comparison every night
Every file is compared against the versioned state. Anything unexpected shows up on the first night, not after weeks.
Content validation
Pages and texts are checked for tampering every night, including spam pages and injected links.
Back in minutes
If something shows up, the last clean state is rolled out again. The analysis runs on the copy, not on the live website.
Read on: Updating WordPress safely, Staging environments compared and, for stores, Online store hacked.
An update alone is not enough: for almost half of all WordPress vulnerabilities there is no patch yet when they are published. That is why nightly monitoring is part of it.
Quick answers.
How can I tell that my WordPress website has been hacked?
Common signs are redirects to other people's sites, often only for visitors on phones or coming from Google search, unknown administrators in the admin, spam pages under your domain when you search for site:your-domain.com, notices from your host about spam being sent or malware, and messages under Security issues in Google Search Console.
Can I just restore a backup?
Only if the backup was definitely made before the break-in. Many hacks go unnoticed for weeks, and by then the backups are infected too. And even a clean backup brings the old vulnerability back: without an update and new credentials, the website is soon infected again.
Why does my website keep getting hacked?
Almost always because a backdoor was left behind or the actual vulnerability was not closed. Attackers like to set up several hidden ways in, for example as an inconspicuous PHP file in the uploads folder or as an extra admin account. According to Sucuri, almost half of all infected websites had such a backdoor.
How do I get rid of the Google warning?
First clean up the website completely, then request a review in Google Search Console under Security issues and briefly describe what you did. According to Google, the review takes from several days to a few weeks.
Do I have to report a hack to the data protection authority?
If personal data could be affected, such as inquiries from the contact form, customer accounts or newsletter addresses, generally yes: within 72 hours of becoming aware of it (Art. 33 GDPR), unless a risk to the people affected is unlikely. This is not legal advice; if in doubt, clarify it with your data protection officer.
Will my host help with a hack?
When spam is being sent or malware is found, hosts often block the hosting plan or individual folders and send a notice. They usually do not clean up the website itself; as the operator, that is your responsibility. The backups in the control panel are helpful, and how long they are kept depends on your plan.