Your site is redirecting to something you have never seen, or Chrome is showing a red warning, or a customer just emailed to ask why your homepage is in Russian. The instinct is to start deleting things immediately.
Do not. The most common reason a hacked site gets reinfected within days is a cleanup that removed the visible damage and left the way in wide open.
Work through this in order.
Minutes 0 to 10: stop the bleeding and preserve the evidence
Take a full backup of the site as it is now. Infected, broken, all of it. This feels wrong and it is essential. That copy is your only record of what the attacker changed, where the backdoor is, and how they got in. If cleanup goes badly, it is also your only way back to the current state.
Then take the site offline. Maintenance mode or a temporary holding page. Every minute a compromised site stays up, it is redirecting your customers, damaging your search reputation, and possibly sending spam that will get your domain blacklisted.
Yes, downtime costs you. An hour of maintenance page costs far less than three more days of serving malware to visitors.
Note the time and what you saw. The exact symptom, when you first noticed, what was different. In an hour you will not remember accurately, and this matters when you are working out how far back to restore.
Minutes 10 to 25: lock every door
Assume every credential connected to the site is compromised, because you do not yet know which one was used.
- All WordPress administrator passwords.
- Hosting control panel and SFTP or FTP accounts.
- The database user password (remember to update wp-config.php to match).
- Your domain registrar login. If they take the domain, nothing else matters.
- The email account that receives your password resets.
Then force all users to log out, so any active session the attacker holds is killed. Changing a password alone does not always end an existing session.
Next, read your user list and delete any administrator account you cannot personally account for. Also check the Users list for accounts created in the last few weeks that you did not create.
The fix: while you are in there, turn on two-factor authentication for every remaining admin account. A stolen password stops being enough, which closes the most likely route back in.
Minutes 25 to 45: find out what actually happened
Now investigate, before cleaning.
Run a malware scan, ideally more than one tool. Check file modification dates for anything changed recently that should not have been. The usual suspects are wp-config.php, .htaccess, index.php, the theme's functions.php, and any PHP file sitting in wp-content/uploads, which should contain no PHP at all.
Check your hosting access logs around the time the modified files changed. You are looking for the request that did it. This is what tells you whether it was a plugin exploit or a login, and that answer determines whether cleaning the files is enough.
Also list your plugins and check whether any are running a version with a published vulnerability. Nine times out of ten, that is your answer.
Minutes 45 to 60: clean, or restore, and close the hole
Two routes.
Restore from a clean backup if you have one from before the infection and you can afford to lose the content in between. This is faster and more reliable than manual cleaning. The catch: if you do not know when the infection started, you may restore an already-infected copy.
Clean manually if a good restore point does not exist. Replace WordPress core and all repository plugins and themes with fresh copies from official sources, which handles modified files in one move. Then hunt the custom code, the database, and any backdoor files by hand.
Either way, the last step is non-negotiable: close the entry point. Update or remove the vulnerable plugin. If you skip this, you will be doing all of it again next week.
Then bring the site back up, request a review in Google Search Console if you were flagged, and keep scanning daily for a fortnight to catch a backdoor you missed.
The honest problem with this checklist
It assumes you have an hour, know your way around file permissions and access logs, and are not simultaneously trying to run a business. On a Friday evening, most owners have none of that.
Every Up Speed plan includes scheduled off-site backups with one-click restore, malware scanning, and the care SLA that matters most here: if your site breaks, we fix it. Not an alert. The actual work. Support response is within 48 hours on Starter and 24 hours on Professional.
If an hour of your site being down is genuinely expensive, that response window is the thing to look at. The Premium plan adds a 1-hour emergency response SLA and a dedicated point of contact who already knows how your site is built, which is worth a great deal when the clock is running.