If you’re reading this, your website is probably doing something strange: it redirects to other pages, Google warns that it’s dangerous, posts appear that you didn’t write, or it simply won’t load. First things first: stay calm. What you do in the first hour determines whether the issue remains a scare or if attackers return within a week.
Would you prefer us to take a look? We provide a free diagnosis today, or call us at 605 88 00 09.
Are you sure it’s a hack?
The clearest signs: Google or your browser warns that the site is dangerous, searching site:tudominio.com shows pages in other languages or from casinos and pharmacies, there are administrators you don’t recognize, or your clients tell you the website leads them to another page (often only on mobile). We explain these in more detail in the 6 most common WordPress hacks.
What to do in the first hour
- Don’t delete anything yet. What you see (spam pages, strange files) is usually not the important part. The key is the backdoor they used to enter; deleting blindly loses the clues needed to find it.
- Create a backup of the current state, including files and database, even if infected. This isn’t for restoration but for analysis. Save it separately and mark it as infected.
- Change passwords from a clean computer: WordPress administrators, hosting control panel, FTP, database, and the email account used to log into WordPress.
- Review administrator users and remove any you don’t recognize. Before removing them, note their username and registration date: this helps determine when the breach started.
- If the website collects customer data (forms, registrations, store), think about your customers. If you suspect personal data has been stolen, GDPR requires you to notify the Data Protection Agency within 72 hours. If there are credit card payments, also notify your bank or payment gateway.
- Notify your hosting provider. They can see access logs and processes that you cannot, and they may have already detected the issue.
What not to do
- Restoring the latest backup without analysis. The infection may have been present for weeks: if you restore a backup that was already infected, nothing is fixed.
- Installing multiple security plugins at once and assuming the problem is resolved because the scanner shows green. Many backdoors are specifically designed to evade detection.
- Deleting only visible threats. If the backdoor remains, attackers will return within days.
- Paying a ransom demand. This guarantees nothing and marks you as someone who pays.
Afterwards: real cleanup
Once the bleeding is stopped, thorough cleaning is required:
- Find the entry point: almost always an outdated plugin or theme, a weak password, or a plugin downloaded from an unofficial source. If this door isn’t closed, nothing else matters.
- Compare each file with the original version of WordPress and each plugin, reviewing one by one any discrepancies.
- Clean the database: remove spam entries, intruder users, and hidden code in settings.
- Update everything and remove abandoned plugins that no longer receive patches.
- If Google marks the website as dangerous, request a review via Search Console (Security Issues) once the site is clean. This usually takes a few days.
How much does it cost to fix?
It depends on how far the attack has spread. That’s why we always start with a diagnosis, which is free and provided on the same day: we check what happened, how they entered, and the extent of the damage. If the fix is straightforward, we do it for free when you sign up for maintenance; if it’s more serious, we provide a diagnosis and a quote, with no obligation.
Preventing recurrence
Most hacks we clean could have been avoided with basic measures: controlled updates, off-hosting backups, and active monitoring. You can find the key points in WordPress Security: 8 Keys and pricing details in how much WordPress maintenance costs. And if you prefer to leave it to us, our WordPress maintenance starts at €19/month + VAT.
Is your website hacked right now? Request your free diagnosis and we’ll tell you today what’s going on.
