WordPress Got Hacked or Keeps Getting Attacked? Your 2026 Security Fix Guide

If your WordPress site suddenly redirects visitors to a gambling page, drops out of Google search results overnight, or locks you out of wp-admin, you have almost certainly been hacked.

The confusing part is that nothing looks broken from the outside. Your posts are still there. Your homepage still loads when you check it. Then a customer emails to ask why your site is showing ads for something you have never heard of, or you open Google Search Console and see a bright red security warning. By the time you notice, the attacker has usually been inside for days or weeks.

WordPress runs more than 40% of the web, which makes it the single biggest target online. Most attacks are not personal. Bots scan millions of sites a day looking for one outdated plugin or one weak admin password, and they move on the second one opens.

This guide is the fix, in order: confirm the compromise, clean it, then close the door so it does not happen again next week. Most of that comes down to steady upkeep. If you would rather hand that off, WordPress maintenance is the kind of ongoing work that can run without you thinking about it.

Why This Happens (It Is Almost Never WordPress Itself)

WordPress core is actually well maintained. The problem lives in the plugins. Patchstack’s 2025 data found that 91% of newly disclosed WordPress vulnerabilities were in plugins, not core, and 2026 trackers put the plugin ecosystem behind roughly 96% of CMS breaches.

Bots do not knock politely. When a plugin vulnerability is published, automated scanners test every site running that plugin within hours. If your site is not updated, you are simply the easiest target in the herd.

Real-world causes, in rough order of how often they show up:

• Outdated plugins, themes, or WordPress core. A patch exists and it was never installed.
• Abandoned or pirated plugins. Nulled plugins are a classic hiding place for backdoors.
• Weak or reused admin passwords with no two-factor authentication. Brute force and credential stuffing still work.
• Stolen session cookies or leaked hosting and FTP credentials. The attacker logs in as you, so nothing looks wrong.
• Outdated PHP. Around 86% of WordPress sites run software or a PHP version that is already out of support.

Notice what is missing from that list. It is rarely “a genius hacker targeted you”. It is almost always an unpatched, unprotected door that a bot found automatically at 3am.

How to Confirm Your Site Is Actually Hacked

Run this checklist now. It takes about 10 minutes, and it separates a real compromise from a broken plugin or a caching glitch.

1. Open your site in a private window and on your phone. Hacked redirects are often mobile-only or Googlebot-only, so a normal desktop visit can look perfectly clean while real visitors are being sent somewhere else.
2. Search site:yourdomain.com on Google. Look for pages you did not create, especially casino, pharmacy, or garbled foreign-language spam.
3. Open Google Search Console and check the Security Issues tab. “Hacked: Content” or “Deceptive pages” means you are confirmed compromised.
4. Check the Users screen in wp-admin. Any admin account you did not create, or an unfamiliar email address in Settings, is a red flag.
5. Check your hosting panel for spikes. Unexpected outbound email volume or a sudden CPU jump usually means your site is quietly sending spam.
6. Run a free scan. Wordfence’s free scanner and Sucuri SiteCheck both flag known malware and changed core files. A clean result is not a guarantee, because a well-hidden backdoor can stay invisible to scanners.
7. If the scan is clean but redirects continue, assume a database backdoor. Check the wp_options and wp_posts tables for injected script tags, plus any unknown file in wp-content/mu-plugins.

The Fix: Clean the Site, Then Close the Door

Work through these in order. Cleaning before you contain the site just gives the attacker time to reinfect it while you work.

Step 1: Snapshot everything before you touch anything

Take a full backup of your files and database first, even though it is infected. Attackers often delete data to cover their tracks, and this backup is your evidence and your safety net. Most hosts offer a one-click backup, and free plugins like UpdraftPlus do the same job. If you already have a clean backup from before the hack, you have the fastest fix available and you can jump straight to Step 3.

If the site is actively redirecting visitors, ask your host for a maintenance page. “Under maintenance” loses far less trust than serving spam.

Step 2: Find the entry point (free)

The goal is not just to find the malware, it is to find out which plugin or weak credential let the attacker in. Clean the infection and leave the vulnerability open, and you will be hacked again within days.

Start with Wordfence, which compares your files against a clean reference and lists anything modified, added, or known-bad. Cross-check any flagged plugin against Wordfence’s vulnerability database to see which version closed the hole.

Step 3: Clean it (free first, then paid)

If you have a clean backup: restore it. That is the fastest and most reliable recovery, because it removes malicious files and database changes in one move. If you are not sure which backup plugin to trust, here is a comparison of WordPress backup plugin options.

If you do not have a clean backup: remove the malware by hand. Delete flagged files rather than overwriting them, delete and reinstall WordPress core, plugins, and themes from fresh downloads, remove any admin user you did not create, and clear out unknown files in mu-plugins and the uploads folder.

If the cleanup is more than you want to take on, this is exactly where a paid tool earns its place. Wordfence’s paid tiers, Sucuri, and MalCare all bundle malware removal with their protection, so you are not just buying a scanner, you are buying someone else’s expertise. If you would rather handle the cleanup yourself but want live protection while you do it, Wordfence Premium (around $149/year) gives you real-time firewall rules and threat signatures, where the free version delays new rules by up to 30 days.

Step 4: Reset everything the attacker could have touched (free)

This is the step most people skip, and it is the reason they get hacked twice.

• Change every admin password and force a password reset for all users.
• Rotate your WordPress salts and security keys in wp-config.php using the official WordPress salt generator. This logs everyone out and kills any stolen session cookies.
• Rotate your database password, hosting panel password, and FTP/SFTP credentials.
• Revoke and reissue API keys for email, payments, and any CDN or analytics service.
• Turn on two-factor authentication for every admin account.

Step 5: Close the door, then verify it stayed closed

• Update core, every plugin, and every theme. Delete anything unused or abandoned.
• Disable file editing by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php.
• Lock down logins. Limit login attempts, and restrict or disable XML-RPC if you do not use it.
• Run a firewall. The free Wordfence plugin blocks brute force and common exploits. Real-time rules need Premium.
• Request a review in Google Search Console once the site is clean, so the hacked label is removed from search results.
• Set up automatic backups and malware monitoring so the next attempt is caught in hours instead of weeks.

Then verify it worked. Re-run the confirmation checklist: no redirects in a private window, no spam pages in a Google site: search, no security warning in Search Console, and a clean scan. Keep watching for a week, since reinfection shows up fast if the entry point is still open.

Quick Comparison of the Fix Options

If you decide to pay for protection, these three cover the same job: scan, block, and clean.

When It’s Worth Paying (and When Free Is Enough)

Be honest about the math. If you run a small blog with no revenue, the free route is genuinely enough: keep everything updated, turn on two-factor authentication, run the free Wordfence firewall, and keep automatic backups. That combination stops the vast majority of automated attacks.

Paying starts to make sense in three situations. First, the site earns money or captures leads, so every hour offline has a real cost. Second, you have been hacked more than once, which means your setup has a gap you have not closed. Third, you simply do not have the hours to handle updates and cleanups yourself.

Frame it as time, not features. A cleanup that eats a weekend, or a week of lost sales while Google shows a security warning, costs far more than a $99 to $149 annual tool on autopilot.

There is one more layer most people forget: the hosting itself. If your site keeps getting hit on cheap shared hosting with no firewall, no isolation, and no backup, you are patching a leaky roof instead of fixing it.

What Kinsta Actually Does Differently (and Why It Ends the Hack Cycle)

Everything above is you fighting bots one at a time. The host is the one layer that can stop most of them before they ever reach your site. Here is what Kinsta runs under the hood, and why it matters when you are the one who has to clean up.

Every site runs in its own isolated container

On shared hosting, hundreds of sites sit on the same server sharing the same PHP and database service, so one weak plugin on a neighbor’s site can reach yours. Kinsta runs each site in its own orchestrated container, with Linux, Nginx, PHP, and MySQL fully separated and nothing shared between sites. A hack on one account cannot touch another, and every site gets dedicated resources, so no noisy neighbor drags your pages down.

A managed firewall and DDoS protection at the edge

Kinsta puts a fully managed web application firewall and Cloudflare-powered DDoS protection in front of every site, backed by enterprise firewalls and a private network. Brute-force logins, exploit scans, and traffic floods are filtered before they ever touch WordPress. On cheap hosting, that protection is a plugin you install yourself and hope you configured right.

Backups and platform patches handled for you

Daily automated backups of your files and database are kept for at least 14 days, so a clean restore point is always waiting. Kinsta also patches the operating system and platform security for you, which is the part most hosts leave you to track and most site owners never do.

A hack-fix guarantee, not a paid cleanup

If something still gets through, Kinsta’s security engineers remove the malware and restore the site at no extra cost. Every plan includes it. That is the exact job this guide just walked you through, handed to the team whose full-time job it is.

The details that close the usual doors

Free SSL with forced HTTPS, one-click staging so you can test updates before they go live, a built-in CDN with advanced caching, 30 data centers, and an uptime guarantee of up to 99.99%. Kinsta bundles roughly $300 of tools that most people pay for separately: the CDN, caching, backups, uptime monitoring, and SSL certificates.

Add it up. The cleanup hours, the lost traffic, the week Google shows a security warning, the weekend you spend reinstalling plugins. A host that isolates your site, patches it for you, and fixes a hack for free is not an upgrade for perfectionists. It is the difference between running a website and constantly repairing one. If a single hack has ever cost you a week of sales, the switch pays for itself the first time it blocks one.

Not ready to switch hosts yet? It is worth comparing your current hosting options against what you actually need before you migrate.

Frequently Asked Questions

Final Thoughts: Do This in the Next 10 Minutes

1. Confirm the problem. Check for redirects in a private window, search site:yourdomain.com for spam pages, open the Search Console Security tab, and run a free scan.
2. Lock it down today. Change your admin password, turn on two-factor authentication, and rotate your WordPress salts. Five minutes of work that ends a stolen session immediately.
3. Then clean and patch. Restore a clean backup if you have one. If the scan flags malware you cannot remove, get expert cleanup rather than leaving a backdoor open.

If this is the second or third time you have been here, stop treating the symptom. Move the site to hosting with a real firewall and a hack-fix guarantee, and let the cleanup problem become someone else’s job.

This post contains affiliate links. If you buy through them, I may earn a small commission at no extra cost to you.

About The Author

Marcus Li

Marcus Li is a web designer and marketing specialist based in Vancouver, BC. After years of helping clients build their online presence, he discovered how AI tools could level the playing field for everyday entrepreneurs. He shares what actually works, no fluff, no hype.

See author's posts