WordPress Hacked: What to do (And How to fix it) 5 Easy steps

First of all, don’t panic; getting your WordPress hacked is shocking. Imagine waking up and discovering that your WordPress website has been hacked. The situation is among the most upsetting ones. Even though millions of people use WordPress today, it continues to be one of the most frequently hacked content management systems (CMS).

So much so that Every day, on average, 30,000 websites are hacked worldwide, with 43% of those attacks going after small businesses. According to Sucuri’s yearly report on hacked websites, WordPress was the most frequently hacked CMS (content management system) in 2022. WordPress websites had infections with over 96.2% claims by Sucuri reports.

There can be many ways your WordPress might get hacked, including a pirated theme, plugin, or so-called third-party pro plugin. If you want to be sure that your plugin is secured and not vulnerable, you can check out the WordPress Core Vulnerabilities: Patched Report of June. They have analyzed more than 100 plugins for vulnerabilities; additionally, their report claims that they analyzed 23 with no paths, so you can uninstall those.

Here is an image that shows the no path plugin.

Now lets see Symptoms that show that your site is WordPress hacked.

Sign that Indicate your WordPress is Hacked

• Sudden drop in website traffic

If you notice a sudden drop in website traffic, even though your Google Analytics is set up properly, this could be a sign that your WordPress site is hacked. This is because hackers may redirect non-logged-in visitors to spam websites.

You might also want to check for Google algorithm updates; if Google releases a core, there might be a possibility that your website traffic suddenly drops.

• Bad links added to your website

Hackers may add links to spammy websites to your WordPress site. These links are usually added to the footer of your website, but they could be anywhere.

• Your website has changed without your intervention.

If your WordPress site has changed without your intervention, such as the homepage being replaced with a static page or new material being uploaded, this might indicate that your site has been hacked.

• Your site is redirecting to another site

If your WordPress site is redirecting to another site, this is a clear sign that your site has been hacked.

• When you or other users try to access your site, you get a warning in your browser

If you or other users get a warning in your browser when you try to access your WordPress site, this is a sign that your site has been hacked.

• When you search for your website, Google warns you that it may have been hacked.

If you search for your WordPress site in Google and you see a warning that it may have been hacked, this is a clear sign that your site has been compromised.

How to fix Your WordPress website Hacked 

1. Don’t Panic 

Don’t panic initially, that’s what you need to do. If your website has been hacked, it’s fair to feel unhappy, but freaking out will only make matters worse. Being a website owner myself, I am aware of how difficult it is. But I really think you will overcome this. Try to put more emphasis on solving the issue and obtaining the hack. Prepare your attitude and consider how to recover your website. If you need time to fix a WordPress hack, don’t rush and put your website in maintenance mode. 

To solve the issue, take a deep breath and adhere to these procedures. 

2. Put your Website in Maintenance mode

Now that you’ve confirmed that your website has been backed, you need to put it in maintenance mode. This will stop users from visiting your website until you resolve the issue. By including the following code in your wp-config.php file, you may place your website in maintenance mode:

1. Access your website’s files.
2. Locate and open the wp-config.php file.
3. Before “That’s all, quit editing!” the following code has to be inserted. Enjoy your posting.

define('WP_MAINTENANCE', true);

4. Save and upload the modified wp-config.php file.

That’s it! Your website is currently being maintained. Remember to remove the code once you’re done.

3. Scan Your WordPress Hacked Website

Hackers frequently build backdoors so they may remotely access your website.

You may safeguard your website with one of the several external remote scanners that are now on the market. that alerts you when your website is in danger. With their assistance, you may check your website to see where the hack is located. You might also start scanning your immediate area in addition to that.

Scanning tools – such as Sitecheck, VirusTotal, etc. 

Sitecheck – Just enter the URL and it will alert you about malware and hacking.

VirusTotal– Analyze suspicious files, domains, IPs and URL

4. Reset your Password

The next thing you must do is update your WordPress passwords. You may reset passwords for FTP, databases, hosting accounts, CMS admin accounts, cPanel, and other WordPress-related accounts. The accounts that share the same password with your hosting account. 

To do so, follow the steps below:

Resetting WordPress Admin Password:

1. Navigate to your WordPress site’s login page.
2. Click on the “Lost your password?” or “Forgot your password?” link.
3. Enter your username or email associated with the admin account.
4. A link to reset your password should be in your inbox.
5. Set a new password by clicking the link and then adhering to the directions.

Resetting FTP Password:

1. Log in to your hosting account’s control panel or use an FTP client.
2. Find the section related to FTP or FTP accounts.
3. Select the FTP account for which you want to reset the password.
4. Look for an option to change or reset the password.
5. Enter a new password and save the changes.

Resetting Database Password:

1. Access your hosting account’s control panel or use a database management tool like phpMyAdmin.
2. Locate the section for managing databases or MySQL databases.
3. Your WordPress website’s database should be opened.
4. Find the table named wp_users (or similar).
5. Look for the row that corresponds to your username and click on the “Edit” or “Browse” option.
6. In the password field, delete the existing password and enter a new one.
7. Save the changes.

Resetting Hosting Account Password:

1. Visit your hosting provider’s website.
2. Log in to your hosting account using your current credentials.
3. Navigate to the account or security settings.
4. Find the option to change or reset the account password.
5. To create a new password, adhere to the specified directions.

Resetting cPanel Password:

1. Go to your hosting provider’s website and log in to your hosting account.
2. Locate and access the cPanel section.
3. Look for the option to change or reset the cPanel password.
4. Enter a new password and save the changes.

5. Reset All Access

Locking down the system to stop more changes is one of the first things you should do when finding a WordPress hacked site that has been compromised. An excellent place to begin is with your users. Forcing a global password reset for all users, including administrators, is one way to do this.

This plugin can help you with this step: Security by iThemes

Additionally, you can also use Password generator to generate some strong passwords.

Moreover, you should log out any users who might still be signed in to WordPress. To accomplish this, modify the secret keys in wp-config. The WordPress key generator is a fresh set that you must make. Take those numbers, then replace your wp-config.php file’s existing values with the new ones. Anyone who could still be logged in will be forced to log out.

Additional Security checks & Solution

If you did not find the above solution on WordPress hacked helpful, then these simple bullet points might just get your site secure.

• Limit Login Attempts
• Enable Two-Factor Authentication
• Choose Reliable Themes and Plugins
• Remove Unused Themes and Plugins
• Regularly Backup Your Website
• Use Secure Hosting (Some are Nestify, Cloudways, Vultr and AWS)
• Implement SSL Encryption
• Educate Yourself and Your Users
• Monitor User Permissions

Final Say

Securing your wordpress hacked website requires a multifaceted approach that encompasses preventive measures, continuous monitoring, and educating your team. By implementing the strategies outlined in this comprehensive guide, you can significantly reduce the risk of hacks and protect your online presence. Remember, website security is an ongoing commitment that requires regular updates, audits, and staying informed about the latest security practices. Stay vigilant, prioritize security, and ensure your website remains a safe and trusted platform for your visitors.

FAQs on WordPress Hacked

1. How can I prevent my WordPress site from getting hacked?

There are several measures you can take to enhance the security of your WordPress site. These include using strong passwords, keeping software up to date, installing security plugins, limiting login attempts, and implementing two-factor authentication.

2. Can I remove malware from my WordPress site myself?

If you have technical expertise, you may be able to remove malware from your WordPress hacked site. However, it is recommended to seek assistance from a professional or use reputable security plugins to ensure thorough and effective removal.

3. What should I do if my WordPress site keeps getting hacked repeatedly?

If your site is repeatedly getting WordPress hacked, it’s essential to investigate the root cause. Consider working with a security expert who can identify vulnerabilities, strengthen security measures, and provide ongoing monitoring and support.

4. How often should I back up my WordPress site?

It’s recommended to back up your WordPress site regularly, ideally on a daily or weekly basis. The frequency may depend on how frequently your site’s content is updated and how critical the data is.

5. Can I recover my website without backups?

While having backups is the best way to recover your website, there are professional services available that specialize in WordPress hacked recovery. However, these services may be more time-consuming and costly compared to restoring from backups.