Your website was hacked, you cleaned it up, it works. A sigh of relief.
A week later — the same thing again. Because cleaning up removes the consequence, not the cause.
First: how did they get in
It is almost always one of four things:
An old plugin or theme. The most common. Check whether anything hasn’t been updated for months — and especially anything its author has abandoned.
A weak or stolen password. Look in the logs for logins from unfamiliar countries.
Another website on the same server. If you have five websites on one account and one of them is old, it is the way in for all of them.
A compromised computer. If your password is saved in an FTP program on an infected computer, changing it on the server won’t help.
What has to be changed
Not just the admin password. All of them:
- WordPress administrators — all of them, not just yours
- The database password (and in
wp-config.php) - FTP and cPanel
- Email accounts on the domain
And log out all sessions — a changed password doesn’t end the attacker’s existing login.
The secret keys in wp-config
Those eight lines with AUTH_KEY and the like. If the attacker knows them, they can keep their session alive.
Generate new ones at api.wordpress.org/secret-key/1.1/salt/ and replace them. That logs out every user — which is exactly what you want.
Look for what they left behind
Attackers leave themselves a way back in:
A new administrator. Check the list of users — sometimes the name looks harmless.
A hidden file. Usually in uploads — there shouldn’t be a single .php file there. If there is one, it is a back door.
A scheduled task. In cron or in WP-Cron, bringing the infection back.
A modified .htaccess that redirects some of your visitors elsewhere.
Check whether Google has flagged you
In Search Console → Security Issues. If you have been flagged, request a review after the cleanup — otherwise the “This site may be harmful” warning stays for weeks.
Backups — carefully
Don’t restore the latest automatic one. It probably already contains the infection.
Find out when it started (from the dates of the modified files) and restore an older one. Better to lose three days of content than to bring the problem back.
So it doesn’t happen again
Updates switched on, two-factor login, a different password everywhere, and backups stored off the server.
A backup on the same server that was hacked isn’t a backup.
Want someone to keep an eye on things for you — updates, backups and monitoring?
Maintenance →