My WordPress Site Was Hacked. What Do I Do Right Now?

First, breathe. A hacked site is fixable, your business will survive this, and the next hour matters more than the last one. Here is exactly what to do, in order. Then we will talk about what it costs, why this happened to you, and how to make sure you never do this twice.

What should I do in the first hour?

1. Contact your hosting company. Tell them your site is compromised. Most hosts have seen this thousands of times and many will scan, quarantine, or restore from a backup. Ask what backups they hold and how far back they go.
2. Change your passwords. Your WordPress login, your hosting account, and your email. Use long, new passwords. Email matters because password resets flow through it.
3. Do not delete anything yet. It is tempting to start ripping things out. But a professional cleaner needs to see what happened, and a rushed deletion can make recovery harder.
4. Write down what you see. Strange pages, dates, emails from your host. Screenshots help whoever does the cleanup.

Should I pay for professional cleanup?

If your host cannot restore you to a clean backup, usually yes. Malware hides. It buries copies of itself in places an owner will never look, and a site that looks fixed often is not. Professional cleanup typically costs a few hundred to a few thousand dollars.

Here is the fuller picture, plainly: counting cleanup, downtime, and lost customers, the average cost of a hack for a small business is about $14,500. That number is not meant to scare you. It is meant to make one thing clear: the cheap part of this is fixing it properly, once.

Why did my site get hacked?

Not because you did something wrong, and not because whoever built your site did a bad job. The honest answer is architecture.

In 2025, researchers logged 11,334 new WordPress security holes. 91 percent came from plugins. When a new hole becomes public, automated attacks usually begin within hours. Roughly 13,000 WordPress sites are hacked every day, and almost all of them are small sites like yours, found by programs that scan the whole internet without caring who you are.

Every plugin on your site is a separate piece of software, written by a different person, that must stay perfectly updated forever. Miss one update for one week, and that can be enough. Most owners have 20 or more plugins. Keeping up is not a character trait. It is a part-time job.

How do I keep this from happening again?

You have two honest paths.

Path one: stay and defend. Remove every plugin you do not truly need (here is how to decide). Turn on automatic updates. Add a reputable security plugin. Check in weekly. This genuinely lowers your risk. It also signs you up to do it forever, because the treadmill does not stop.

Path two: move somewhere hacks cannot follow. There is a kind of website that has no login page, no database, and no plugins. Nothing to guess, nothing to break into, nothing to keep updated. Your site can be moved there without changing how it looks or losing your address. That is what Shmove does, and the move is free. If your site was just hacked, you are exactly who we built it for. Here is how a move works without losing anything: how to leave WordPress without losing your site.

Either path beats doing nothing. A cleaned site with the same open doors gets found again. It is the pattern hosts see every day: cleanup, quiet months, repeat.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we’ll tell you exactly what’s wrong with your site. Free, 60 seconds, no account needed.