WordPress site hacked? What to do before you hire anyone

You open your site and get a pharma redirect instead of your homepage. Or your Google listing says “This site may be hacked.” Or a customer forwards you a screenshot of your checkout page injecting casino links.

Your stomach drops. You Google “WordPress malware removal” and find 400 freelancers who’ll “clean your site in 24 hours” for ₹3,000.

Stop. Do these things before you hire anyone.

Finding out your WordPress site has been compromised is never convenient. What you do in the next hour matters more than the next month.

First 30 minutes: contain the damage

1. Do NOT delete anything

Your first instinct will be to delete suspicious files or reinstall WordPress. Don’t. You’ll destroy the evidence a competent security person needs to find the entry point, and if you delete files without understanding how the attacker got in, the site will get reinfected.

2. Take a full backup — right now

The site is compromised, but back up everything anyway:

• Full database export (via phpMyAdmin or WP-CLI)
• Complete wp-content folder (themes, plugins, uploads)
• Root directory files (.htaccess, wp-config.php)

This backup is your forensic evidence. Label it “compromised-backup-[date]” and store it somewhere other than your server.

3. Change your passwords — all of them

Change every one of these, including but well beyond your WordPress admin:

• WordPress admin and all user passwords
• FTP/SFTP credentials
• Database password (update wp-config.php to match)
• Hosting panel (cPanel/Plesk) password
• Any API keys stored in the site

If you reuse passwords across services (you shouldn’t, but most people do), change those too.

4. Check for unknown admin users

Go to Users → All Users in WordPress admin and sort by role. If you see administrator accounts you don’t recognise, that’s your attacker’s backdoor. Screenshot them first, then remove them.

If you can’t get into wp-admin at all, check the database directly:

SELECT * FROM wp_users WHERE ID IN (
  SELECT user_id FROM wp_usermeta WHERE meta_key = 'wp_capabilities' AND meta_value LIKE '%administrator%'
);

Lock everything down before you start cleaning. A clean site with the same credentials gets reinfected overnight.

What’s actually happening to your site

Most WordPress hacks follow a few patterns, and knowing which one you have tells you where to look.

Pharma hack

Your site looks normal to you, but Google sees thousands of spam pages (Viagra, Cialis, casino links) injected into your sitemap or database. Search site:yourdomain.com in Google. If you see pages you didn’t create, this is it.

Entry point: usually a nulled (pirated) theme or plugin with an eval() backdoor.

Redirect hack

Visitors get redirected to spam sites, but only some of the time. The malware checks whether the visitor came from Google, is on mobile, or is visiting for the first time, which makes it hard to reproduce.

Entry point: injected JavaScript in your theme’s header.php or footer.php, or a modified .htaccess file.

Backdoor infection

There are no visible symptoms, but the attacker has ongoing access. They might be using your server to send spam email, host phishing pages or mine crypto.

Entry point: a PHP file disguised as a legitimate plugin file, often in wp-content/uploads/ (where PHP files should never be).

SEO spam injection

Your content has been modified to include hidden links to other sites. You won’t see them on the page, but “View Source” shows dozens of links in tiny white text pointing to gambling or loan sites.

Entry point: a compromised database. The malware lives in post content or widget areas instead of in files.

The five things a competent WordPress security person does

When you hire someone to clean a hacked site, expect this standard of work. Anyone who skips a step is painting over the problem.

Step 1: Forensic scan

Check file modification dates, compare core files against WordPress checksums, scan for known malware signatures, and review access logs to build a timeline of the first compromise.

Step 2: Identify the entry point

This is the most important step, and most cheap cleanups skip it entirely. How did the attacker get in? A nulled plugin? A weak password? Outdated PHP? A vulnerable plugin with a known CVE? If you don’t find out, you’ll be hacked again.

Step 3: Manual cleanup

Running the Wordfence or Sucuri scanner is only the start. The cleanup means reviewing suspicious files by hand, checking the database for injected content, removing backdoor files and cleaning modified core files.

Step 4: Hardening

After cleanup:

• Update all plugins, themes, and WordPress core
• Remove unused themes and plugins entirely
• Block PHP execution in /uploads/ directory
• Set correct file permissions (644 for files, 755 for directories)
• Add security headers
• Implement rate limiting on wp-login.php

Step 5: Monitoring

Confirm the site stays clean for 14–30 days. Set up file integrity monitoring. Register with Google Search Console and request a security review if the site was flagged.

How to tell if the freelancer you’re talking to is any good

Ask these questions. The answers will tell you most of what you need to know.

“What’s the first thing you do when you access a hacked WordPress site?”

• Good answer: “I check file modification dates, review access logs, and take a forensic backup before touching anything.”
• Bad answer: “I run a Wordfence scan.”

“How do you find the entry point?”

• Good answer: “I compare file checksums, look for recently modified files outside of core updates, check for eval/base64 encoded strings, and review user accounts and login logs.”
• Bad answer: “I reinstall WordPress and delete the bad files.”

“What do you do after the cleanup?”

• Good answer: “Harden file permissions, block PHP in uploads, update everything, set up monitoring, and verify for 2-4 weeks.”
• Bad answer: “Install a security plugin.”

“Do you guarantee against reinfection?”

• Good answer: “I guarantee my cleanup work. Reinfection depends on whether you maintain updates and don’t reinstall the vulnerable component. I’ll document what caused the breach.”
• Bad answer: “Yes, 100% guarantee forever.” (That’s impossible. They’re selling certainty they can’t deliver.)

The real cost math

I see this play out again and again:

Approach	Cost	Outcome
Fiverr freelancer, ₹3,000	₹3,000 × 3 attempts = ₹9,000	Keeps getting reinfected because entry point was never found
Security plugin (DIY)	₹8,000/year	Catches known signatures, misses custom backdoors
Competent specialist, one-time	₹25,000–60,000	Forensic cleanup, entry point identified, hardened, monitored
Agency retainer	₹1.5–3 lakh/year	Overkill for a one-time incident, right for ongoing maintenance

The ₹3,000 “quick fix” that gets tried three times before someone finally hires a specialist ends up costing more in money and downtime, and in lost Google trust and customer confidence.

If you’re in Mumbai and this is happening to you right now

I’ve cleaned and recovered enough hacked WordPress sites to know the panic you’re feeling. This is how I work:

1. Diagnostic first: I assess the damage and identify the infection type and entry point before quoting for the cleanup
2. Manual remediation: I go through the files and database myself instead of relying on a scanner
3. Hardening and handoff: you get a documented checklist of what was wrong, what was fixed, and what to maintain
4. 14-day monitoring: I check that the site stays clean after the cleanup

The diagnostic takes 2–4 hours, and the cleanup takes 4–12 hours depending on severity. You get a written report either way.

Fixed pricing, turnaround times and a free infection scan are on my WordPress cleaning service page. Malware removal, Google blacklist recovery and security hardening start from ₹7,000, and most sites are cleaned in 24–48 hours. If you’d like to compare me with the plugins, global services and other Indian specialists first, I wrote a full market comparison that includes the cases where I’m not the right pick.

Don’t panic-hire at midnight. Take the backup, change your passwords, and get in touch in the morning with a clear head. The site will still be there tomorrow, and so will I.