Skip to content

Care & Infrastructure

Hacked, or trying not to be

Two different jobs that arrive through the same door. One is hardening a site so it does not get compromised. The other is cleaning up one that already has been, usually discovered when Google starts warning visitors away or the host suspends the account. If that is happening now, the emergency sequence is below.

How it runs

What actually happens, in order

  1. Contain it

    Hour 1

    Take a forensic copy before changing anything — it is the only record of how they got in, and cleaning first destroys it. Then rotate every credential: hosting, database, WordPress admin, FTP, and any API keys in the code. Reinfection almost always means a credential or a backdoor was missed rather than the original hole reopening.

  2. Clean

    Hours 2–8

    Core, theme and plugin files replaced from known-good sources rather than patched. The database checked for injected content and rogue admin users. Scheduled tasks checked, because a backdoor that reinstalls itself on a schedule is what makes a site appear to get hacked twice.

  3. Find the way in and close it

    Day 1–2

    Usually an outdated plugin with a public exploit, a reused password, or a shared hosting neighbor. Cleaning without finding this is why sites get reinfected within a fortnight.

  4. Get the warning removed

    Day 2, then Google's timeline

    If Google flagged the site, request a review in Search Console with a description of what was found and fixed. Reviews are not instant and a request submitted before the site is genuinely clean will fail and cost more time than it saves.

  5. Harden, so it does not happen again

    Week 1

    Automatic security updates, two-factor on admin accounts, removal of abandoned plugins, file permissions corrected, login rate limiting, and off-server backups. Most compromises exploit something that had a patch available for months.

Scope

What is included — and what is not

Both lists, because the second one is where projects go wrong and almost nobody publishes it.

  • Forensic copy taken before any cleanup
  • Full malware removal from files and database
  • Root cause identified and closed, in writing
  • Every credential rotated
  • Google Search Console review request and follow-through until the warning clears
  • Hardening: updates, two-factor, permissions, login limiting, backups
  • A written report of what was found, what was done, and what to watch
  • Any guarantee that a site cannot be compromised — anyone offering one is selling something
  • Recovery of data that was never backed up, which is sometimes genuinely impossible
  • Legal or regulatory notification if customer data was exposed, which needs your attorney rather than us

Straight answers

Questions people actually ask

My site is hacked right now. What do I do first?
Do not delete anything. Call us, and in the meantime change your hosting and WordPress admin passwords and take the site offline if it is serving malware to visitors. The instinct to start deleting suspicious files destroys the evidence of how they got in, which is the thing that stops it happening again.
How long does cleanup take?
Most WordPress compromises are cleaned within a day. Removing a Google warning takes longer because it depends on their review queue, not on us. If customer data was involved, that timeline is different and is a conversation with your attorney as much as with us.
How did they get in? Was it me?
Overwhelmingly it is an unpatched plugin with a publicly known exploit, found by an automated scanner that was not targeting you specifically. Second most common is a password reused somewhere that was breached. It is rarely personal and it is rarely sophisticated.
Will a security plugin prevent this?
It helps and it is not sufficient. A plugin cannot patch another plugin's vulnerability, and several of the best-known security plugins have themselves had serious vulnerabilities. Updates applied promptly, off-server backups and two-factor authentication prevent far more than any plugin does.
Can it happen again?
Yes. The realistic goal is to make it unlikely, detect it fast, and be able to restore in an hour rather than a week. Anyone promising you cannot be compromised is telling you something they cannot know.

Related

Usually bought alongside

WordPress, built to be maintainable

WordPress sites built without page-builder bloat. Fast, secure, and something your team can actually edit.

Learn more

Someone responsible for your site not breaking

Updates, backups, uptime monitoring and fixes. A named person who answers when something breaks.

Learn more

Start with the free audit. It takes two seconds and it is honest about what it cannot see.

Audit my siteCall (786) 393-7931