You opened your website and something is wrong. Maybe it redirects to a pharmacy site on mobile but looks fine on desktop. Maybe Google is showing “This site may be hacked” under your listing. Maybe your host has suspended the account and sent an email full of file paths you don’t understand.
The good news: a WordPress site hacked this way is almost always recoverable, and most of the damage that follows comes from the hours after it’s discovered, not the hack itself. Panic leads to deleting the wrong files, restoring a backup that’s already infected, or leaving the site down for a week while rankings slide.
Here’s the order of operations we use on clean-up jobs, written so you can follow it yourself. Google’s own guide for hacked sites covers the same ground from the search engine’s side.
First 15 minutes: is your WordPress site hacked, or just broken?
Plenty of “my site’s been hacked” calls turn out to be an expired SSL certificate, a plugin conflict, or a white screen after an update. Before you touch anything, confirm what you’re dealing with.
Check these four places:
- Google Search Console → Security Issues. This is the authoritative source. If Google has detected malware, injected spam pages, or a deceptive redirect, it will be listed here with sample URLs. Google explains what each warning type means in its Security Issues report guide. No Search Console access? Set it up now — you’ll need it later to lift the warning.
- Search
site:yourdomain.com.auin Google. Scroll a few pages. Injected spam shows up as pages you never created — replica watches, essay writing, streaming links, often in another language. - Open the site on mobile data, in a private window. Redirect malware is frequently conditional: it fires only for mobile users, only for first-time visitors, or only for traffic arriving from Google. A site that looks fine when you’re logged in on your office wifi can be redirecting every real visitor.
- Check your inbox for a host notice. Most Australian hosts scan for malware and will email you file paths, or suspend the account outright.
If all four are clear, you probably have a technical fault, not an intrusion.
The four ways WordPress sites usually get hit
Knowing which one you’re looking at changes the clean-up.
Conditional redirects. Visitors get bounced to a spam or scam domain based on device, referrer, or whether they’re logged in. Usually injected into wp-config.php, the active theme’s functions.php, or a .htaccess file. The most commercially damaging type, because it hits customers directly.
Spam page injection (SEO spam). Hundreds or thousands of pages generated in a directory you’d never look in, cross-linked to boost someone else’s site. You’ll often see indexed page counts jump in Search Console.
Card skimmers on WooCommerce. Malicious JavaScript on the checkout page that quietly copies card details as customers type. Rare, but the most serious — it turns a website problem into a customer data problem. If you run WooCommerce and take payments on-site, check this first.
Backdoors. Small PHP files scattered through wp-content/uploads, wp-includes, or a plugin folder, giving the attacker a way back in. This is why sites get re-infected a week after a “successful” clean-up: someone removed the visible symptom and left the entry point.
Should you take the site offline?
The instinct is to pull it down. Usually, don’t.
Take it offline if: you run WooCommerce and suspect a skimmer, the site is serving malware downloads to visitors, or your host has already suspended it. Customer safety beats uptime.
Leave it up if: it’s spam pages or a conditional redirect and you can begin clean-up today. A maintenance page for a few hours is fine. A site that returns errors for a week can lose rankings that take months to rebuild, and Google can’t re-crawl to clear the warning if the site is unreachable.
Either way, do these three things immediately:
- Change every admin password, and the hosting control panel and database passwords. Use a password manager.
- Force a logout of all sessions so an attacker’s active login is killed. Changing passwords alone doesn’t always do this.
- Check Users → All Users for accounts you don’t recognise, especially recently created administrators.
What you can clean up yourself
If you’re reasonably technical and the infection is mild, a self-service clean-up is realistic.
- Run a proper scanner. Wordfence, Sucuri, or MalCare will identify modified core files and flag suspicious code. Free tiers detect; paid tiers usually clean.
- Reinstall WordPress core. Dashboard → Updates → “Re-install version X” overwrites core files without touching your content. Free, and it wipes a whole category of infection.
- Reinstall every plugin and theme from source. Delete and reinstall rather than update in place — updating leaves injected files that aren’t part of the official package.
- Delete anything you’re not using. Deactivated plugins still execute if an attacker calls the file directly.
- Check your
.htaccessandwp-config.phpby eye. Long strings of base64 or hex, or code above the opening PHP tag, are worth investigating.
Where DIY falls down. Scanners compare your files against known-bad signatures and official copies. They’re good at core files and popular plugins, and much weaker at custom theme code, injected database rows, and novel backdoors. If the site is still redirecting after a full scan and clean, if it re-infects within days, or if the malware is in the database rather than the files, you’ve reached the limit of what a plugin will do for you.
That’s also true if you simply can’t afford to be wrong — a clinic, a trades business taking bookings, or a store handling payments has more at stake than a brochure site.
The part nobody tells you about: cleaning up the aftermath
Removing the malware is roughly half the job. The rest is repairing the damage to your search presence, and it has to happen in the right order.
1. Confirm the site is genuinely clean before requesting anything from Google. A failed review makes the next one slower.
2. Request a review in Search Console. Under Security Issues, once you’ve fixed the problem, click “Request Review” and describe what was infected and what you did about it. Vague submissions get rejected; specific ones get approved. Google typically responds within a few days for malware, and can take longer for deceptive-content flags.
3. Get the browser warning lifted. The red “Deceptive site ahead” interstitial in Chrome comes from Google Safe Browsing and clears through the same Search Console review.
4. Remove injected pages from the index. Make the spam URLs return 404 or 410, then use the Removals tool in Search Console for the worst offenders. Don’t redirect them to your homepage — that just moves the problem.
5. Watch your rankings for a month. Sites usually recover most positions within two to six weeks of the warning being lifted, assuming the content and links are intact.
6. Ask your host what got in. A decent host can tell you which file was modified first and from which IP. Without that, you’re guessing about the entry point.
If customer data was involved
This is where a website problem can become a legal one, and it’s worth getting right rather than guessing.
Under the Privacy Act, most Australian businesses turning over less than $3 million are currently exempt from the Notifiable Data Breaches scheme. But that exemption does not apply to everyone — health service providers are covered regardless of turnover, which catches a lot of clinics, allied health practices and psychologists with small websites. Businesses that trade in personal information, handle tax file numbers, or are credit reporting bodies are also covered.
If the scheme applies to you and personal information has been accessed in a way likely to cause serious harm, you have up to 30 days to assess the breach, and you must notify both the affected individuals and the Office of the Australian Information Commissioner.
It’s also worth knowing that the small business exemption is on borrowed time — the Tranche 2 privacy reforms are expected to remove it, with a transition period once legislation passes.
We’re not lawyers, and this isn’t legal advice. If customer data may have been exposed — particularly payment details or health information — talk to someone qualified before deciding you don’t need to notify anyone.
What clean-up costs in Australia
| Option | Typical cost | Realistic for |
|---|---|---|
| Do it yourself | Free + several hours | Simple spam injection, technically confident owner |
| Security plugin (paid tier) | $100–$300/year | Ongoing protection; automated clean-up of known infections |
| One-off professional clean-up | $300–$900 | Most small business sites |
| Emergency / complex / WooCommerce | $1,000+ | Stores, multisite, repeat infections, data exposure |
For reference, our own WordPress malware removal is $499 ex GST for a standard single site, with a 24–48 hour turnaround and a 30-day re-clean guarantee — and clean-up clients get their first month of a care plan free, because the reinfection risk is highest in the weeks straight after.
Be cautious of anyone quoting a clean-up without looking at the site first, or a price that seems too low to include finding the backdoor.
How sites end up here in the first place
Almost every clean-up we do traces back to one of five things:
- An outdated plugin. Not WordPress core — plugins. A known vulnerability in a plugin you forgot you installed is the single most common entry point.
- A nulled theme or plugin. Pirated premium software is frequently distributed with a backdoor already in it. This is not an accident.
- A weak or reused admin password, with no two-factor authentication.
- Shared hosting cross-contamination. One infected site on a badly configured server can reach its neighbours.
- An old staging or development copy nobody has updated in three years, sitting on a subdomain.
None of these are exotic. All of them are prevented by the same unglamorous routine: keep things updated, remove what you don’t use, use strong passwords with 2FA, take off-site backups you’ve actually tested restoring, and don’t install pirated software. WordPress publishes a thorough hardening guide if you want the technical detail.
If you’d rather not think about it every month, that’s what a website maintenance plan is for — updates, monitoring, backups and a person who notices before Google does.
Frequently asked questions
How long does it take to clean a hacked WordPress site?
A straightforward infection is usually cleaned within 24 to 48 hours. Getting Google’s warning removed takes longer — typically a few days after you request a review, because the review is on Google’s schedule, not yours.
Will I lose my Google rankings?
Usually not permanently. Sites that are cleaned quickly and reviewed successfully tend to recover most of their positions within two to six weeks. Extended downtime and repeat infections cause far more lasting damage than the initial hack.
Can I just restore a backup?
Sometimes — but only if you know the backup predates the infection. Most hacks sit undetected for weeks, so the obvious backup is often already compromised. Restoring also loses any orders, enquiries and content since that date, and it doesn’t close the vulnerability that let the attacker in, so you can be re-infected within days.
My host says they cleaned it. Is that enough?
Host clean-ups typically remove the malicious files that tripped their scanner. They usually don’t hunt for backdoors, check your database, remove injected pages from Google’s index, or request the Search Console review. It’s a starting point, not a finished job.
Why does my site keep getting re-infected?
A backdoor was left behind, or the original vulnerability was never patched. Repeat infection is the clearest sign that the first clean-up removed the symptom and not the cause.
Do I need to tell my customers?
It depends on whether personal information was actually accessed and whether the Notifiable Data Breaches scheme applies to your business. If payment or health data may have been exposed, get qualified advice rather than making that call yourself.
