Short answer
Take a full backup of the site as it is, change every password from a clean device, put the site in maintenance mode, and scan for injected code and unknown admin users. Then clean the files and database, update everything, and close the way in. If Google shows a warning, request a review once the site is clean.
Free tool for this
Signs your site is hacked
Visitors are sent to another site, usually only from Google or on mobile. Google shows "This site may be hacked" or a red warning page. Search results show Japanese, pharmacy or casino pages that you never wrote. Your host has suspended the account or emailed about malware. Unknown admin users appear, files change without you touching them, or the site suddenly sends spam email.
Some infections hide from you. They only show to search engines or to visitors who are not logged in, so the site can look fine to you while Google sees something else.
The first hour
Do not delete files in a panic. First take a full backup of the site as it is now, files and database, and keep it. You will need it to trace how the attacker got in.
Then change the passwords for WordPress admins, your hosting account, FTP or SSH, and the database, from a device you trust. If you can, put the site in maintenance mode so visitors are not redirected while you work.
- Back up as isFiles and database, kept for tracing
- Change passwordsAdmin, hosting, FTP, database
- Maintenance modeStop visitors being redirected
- ScanUnknown admins, changed files, injections
- Clean and patchThen close the way in
Try it now: Website Security Grade →
Find what was changed
Check Users in the dashboard for admins you do not recognise. Compare WordPress core files with a fresh copy of the same version, and check the uploads folder, which should hold images and documents but not PHP files. Look at recently modified files, and at the database for injected links or scripts in posts, options and widgets.
A security plugin scanner helps, but it does not catch everything. Database injections and code that hides from crawlers are the usual misses.
Clean it properly
Replace WordPress core with a fresh copy, reinstall plugins and themes from their original sources, and remove anything abandoned. Remove backdoors and rogue users, then rotate the secret keys in wp-config.php so old logins stop working.
Restoring an old backup is tempting but has two problems: you lose recent orders and content, and the backup often contains the same weakness that let the attacker in.
Close the way in
Cleaning without finding the entry point is a temporary fix. The usual causes are an outdated plugin with a known vulnerability, a weak or reused admin password, or another infected site on the same hosting account.
Update core, plugins and themes, delete what you do not use, turn on two-step login, and limit login attempts. If several sites share one hosting account, check them all, because one infected site can reinfect the others.
- Outdated pluginA known flaw nobody patched
- Weak or reused passwordGuessed or leaked elsewhere
- Infected neighbour siteSame hosting account, same door
Clear the Google warning
Open the Security Issues report in Google Search Console. Once the site is clean, request a review and describe what you fixed. Make sure the site is clean first, since a rejected request slows you down.
If search results still show spam pages, check which URLs are indexed and remove them. A host saying the site is clean does not settle it if Google still sees a problem.
Stop it happening again
Keep everything updated, keep backups stored away from the hosting account, scan on a schedule, and watch uptime. Most reinfections come from an entry point that was never closed.
If you would rather not do this yourself, cleanup is a fixed job and a monthly care plan keeps the site updated afterwards.