Quick answer: Don't delete anything yet. In the first hour: put the site in maintenance mode, change every password (hosting, WordPress admin, database, FTP), scan your own computer, take a full backup of the infected state as evidence, notify your host, and check whether Google has flagged the site. Cleanup decisions come after containment — never before.
Finding out your site is hacked is a horrible morning. Redirects to pharmacy pages, a red "deceptive site" warning in Chrome, strange admin users, customers emailing screenshots. Panic makes it worse: the most common first mistake is deleting files that would have told you how the attacker got in — which is exactly how sites get reinfected within weeks.
Here is the first hour, in order.
1. Take the site offline gracefully (5 minutes)
Enable maintenance mode from your host's control panel, or ask your host to do it. This stops the site from infecting visitors, protects your reputation while you work, and — if you sell — stops orders passing through a compromised checkout. Don't just delete the site.
2. Change every credential (10 minutes)
In this order: hosting account password, WordPress admin passwords (all of them), database password, FTP/SFTP accounts, and any API keys stored in the site. Assume the attacker has read everything. If you reused any of these passwords elsewhere, change those too.
3. Scan the computer you manage the site from (10 minutes)
A meaningful share of WordPress compromises start on the owner's machine — a keylogger caught your admin password, not the site itself. Cleaning the site while your laptop is compromised means reinfection within days. Run a full antivirus scan before you touch the site again.
4. Preserve the evidence (10 minutes)
Take a complete backup of the site as it is now, infected — files and database. It sounds counterintuitive, but this is what lets a professional (or you, later) find the entry point: timestamps on modified files, injected code patterns, rogue admin accounts, access logs. Download the last 30 days of access and error logs from your host while they're still available.
5. Notify your host and check for blacklisting (10 minutes)
Your host may already know — and may have isolation, scanning, or clean backups they can offer. Then check the damage radius: search Google for site:yourdomain.com to spot injected spam pages, and check Google Search Console for security warnings. If the site is flagged, you'll request a review after cleanup — noting it now tells you what you're working toward.
6. Decide: clean, restore, or rebuild (the decision that matters)
With the fire contained, you have three paths:
- Restore from a clean backup — the best option if you have a backup that predates the infection and you can identify and patch the entry point. Restoring without fixing the vulnerability just resets the clock on the next hack.
- Professional cleanup — typically $150–500 per incident. Understand what you're buying: removal of this infection, not immunity from the next one. The 20+ plugins that created the attack surface are all still there.
- Rebuild on a platform with nothing to hack — the option most owners don't know exists. If this is your second incident, or your plugins are old, or nobody at your company owns "patching" as a job, the honest math often favors migrating off WordPress entirely. We ran the 3-year numbers in Malware clean-up vs. migration: the real cost.
A useful rule of thumb: first incident on a well-maintained site → clean and harden. Second incident, or a site nobody maintains → stop paying the malware subscription.
FAQ
Should I pay for emergency malware removal right now? Contain first (steps 1–5) — that's free and stops ongoing damage. Then decide with a clear head. Emergency cleanup is legitimate, but it's a recurring cost if the underlying attack surface stays.
How did my site get hacked? Statistically, through a plugin: about 91% of WordPress vulnerabilities disclosed in 2025 were in plugins, and 43% are exploitable without any login. Brute-forced weak passwords and compromised owner laptops are the other common paths.
Will my Google rankings survive a hack? Usually yes, if you act quickly: clean or rebuild, request a Search Console review, and the "deceptive site" flag typically lifts within days. Prolonged infections with injected spam pages do lasting damage — which is why the first hour matters.
If you're reading this mid-incident and want a second opinion on clean vs. rebuild — book a free 20-minute call. We'll look at your site together and you'll leave with a plan either way, whichever path it points to.