Skip to content
Noroxi
Sign in

my wordpress site was hackedYour site may have been hacked.This can be fixed.

If you saw a Google warning, a customer message or a strange redirect, let us look from the outside first. Then three steps, then us if you want.

At most 10 requests (redirects and, if needed, an http retry of the home page not counted) plus the scripts the page loads. No login, no load on the site, 20–40 seconds on most sites. The result appears on this page.

Do this now

Whatever the result, these three steps protect you. The order matters.

  1. Take a full backup from the hosting panel required

    Even an infected backup is evidence and a point to return to during the clean-up.

    Source: WordPress.org · My site was hacked FAQ

  2. Change every password and rotate the salt keys required

    WordPress, hosting, FTP and database passwords; new salt keys in wp-config.php log out every open session.

    Source: WordPress.org · new salt keys

  3. Open the Security Issues report in Search Console required

    This is where you see what Google found on your site and which URLs it flagged.

    Source: Google · Security Issues report

  4. Write to your host recommended

    Ask about other sites on the same server and the server logs; many hosts run a free scan.

    Source: WordPress.org · contact your host
I want to clean it myself: the full guide
  1. 01Put the site in maintenance mode or take it offline briefly so visitors are not harmed.
  2. 02Download a full backup of files and database from the hosting panel (also as evidence).
  3. 03Keep the computer you use for WordPress clean and updated too: the device you log in from must be safe.
  4. 04In Users, delete administrator accounts you do not recognise; confirm the email on your own account.
  5. 05Change every password: WordPress, hosting panel, FTP/SFTP, database, email.
  6. 06Rotate the salt keys in wp-config.php; everyone has to sign in again.
  7. 07Replace the WordPress core with a clean copy (delete and re-upload wp-admin and wp-includes; leave wp-content alone).
  8. 08With WP-CLI, run `wp core verify-checksums` and `wp plugin verify-checksums --all`; changed files are listed.
  9. 09Reinstall plugins and themes from the official source; delete unused ones; remove pirated (nulled) ones.
  10. 10Look for .php files in wp-content/uploads and unknown files in wp-content/mu-plugins; compare .htaccess with a clean backup.
  11. 11In the database, check wp_options (siteurl, home, active_plugins) and search wp_posts for foreign-language posts or <script>.
  12. 12Update plugins, themes and PHP; turn on two-factor authentication.
  13. 13Request a review in Search Console; if blocklisted, apply after the clean-up.
  14. 14For a week, watch the logs and rerun the check on this page; reinfection mostly happens in the first 30 days.
The steps of the WordPress.org guide, in our words

What to expect

  • 80% of site owners clean up the symptoms on their first attempt; the median time is one week.

    Li et al., WWW 2016 (Google data, 2014–2015)

  • 12% of sites that only remove the symptoms are hacked again within 30 days. That is why finding the root cause matters.

    Li et al., WWW 2016

  • Sites that get a Search Console warning clean up in a median of 3 days; sites without one take 8 days.

    Li et al., WWW 2016

Let us clean it

Root-cause analysis, clean-up and re-check for your business's WordPress site.

Included
  • Finding the entry point (root cause) and explaining it in writing
  • File and database clean-up: backdoors, fake administrators, cron entries
  • A re-scan after the clean-up and the Search Console / blocklist appeal
  • A one-page report: what was found, what was done, what prevents a repeat
Not included
  • Buying themes, plugins or licences
  • Hosting and domain fees
  • Redesign and content production
  • Recovering content lost without a backup

We do not promise your site will never be hacked; nobody can. If you see a new sign within 30 days of the clean-up, write to us and we look at the root cause again together.

How to reach us

Write to us for a clean-up

Three fields are enough. You do not have to write a message; we call and ask.

How should we reach you
What did you see? (optional)

By sending you agree that your contact details are used only for this request. Privacy notice below.

Noroxi LLC Wyoming, USA (limited liability company) Türkiye · Istanbul guvenlik@noroxi.com

This guide was last reviewed on October 20, 2026. Privacy Responsible disclosure

Questions people ask

What can an external check not see?
Backdoor files, fake administrator accounts with no posts, modified PHP files and pages shown only to Google. This check reads your site like a visitor; it has no access to files or the database. Looking inside needs hosting access or the read-only Noroxi Connector plugin.
Should I take the site offline?
If visitors are being redirected or malicious code is running, yes: switch on maintenance mode or ask your host for a temporary shutdown. If there are only spam pages or hidden links, the site can stay up; back up first, then clean.
When does the Google warning go away?
After the clean-up you need to request a review in Search Console. In Google's 2014–2015 data, Safe Browsing appeals were resolved in a median of 22 hours and search-quality (spam) appeals in a median of 5.6 days (Li et al., WWW 2016).
Could personal data have leaked?
If you store member, order or form data, yes, it could. If you find traces (an exported table, an unknown admin login), the GDPR may require you to notify your supervisory authority within 72 hours of becoming aware. This is not legal advice; ask your lawyer. GDPR · Article 33
Can an up-to-date site be hacked?
Yes. A stolen password, a weak hosting account, a pirated theme or an infection from another site on the same server affects an up-to-date install too. Current versions do not mean "not hacked"; that is why we check.