WEB SECURITY

How Did My WordPress Site Get Hacked? How to Find the Cause and Fix It

MarketStreet Websites Editorial Team • October 22, 2026

If you are asking "how did my WordPress site get hacked?", you probably just found spam pages, a redirect, a strange admin user or a Google warning. The good news: most WordPress hacks come through a handful of well-known doors, and you can usually find which one. This guide walks through the likely causes, how to check each, and a recovery checklist built on WordPress.org's and Google's own guidance. For the broader background on why WordPress is targeted, see our earlier guide on why WordPress websites get hacked.

The usual ways WordPress sites get hacked

1. A vulnerable plugin or theme

WordPress's own hardening guide notes that most vulnerabilities are in plugins and themes rather than core, and that keeping everything updated is the single most important step. Automated bots scan the web for sites running a version with a published flaw. Abandoned plugins, ones no longer updated by their developer, are especially risky.

How to check: list every plugin and theme with its version. Look up each one's changelog for recent security fixes. Note any you have not updated in months, and any you installed and forgot about, including inactive ones.

2. A weak or reused password

Login pages are hit constantly with password-guessing attacks. If an admin password was reused on a site that leaked, attackers may simply log in.

How to check: Users > All Users. Look for admin accounts you don't recognize, and check when each admin last logged in if you have a log.

3. Compromised hosting or FTP access

Stolen hosting, FTP or database credentials bypass WordPress entirely. On shared hosting, a poorly isolated neighbor can also be a factor.

How to check: ask your host for access logs around the date the problem began, and whether other sites on your account are affected.

4. Nulled (pirated) themes and plugins

"Free" copies of paid themes often ship with backdoors built in. If you installed one, assume it is the cause.

Recovery checklist

1. Don't panic-delete. Take a full backup of the hacked files and database first. It is evidence and helps find the entry point.
2. Change every password: all WordPress admins, hosting control panel, SFTP/FTP, database, and the email account tied to the admin.
3. Contact your host. WordPress.org's "My site was hacked" FAQ recommends working with your host, who can see server logs and may help clean up.
4. Restore or clean. If you have a backup from before the hack, restore it. Otherwise, reinstall WordPress core, plugins and themes from official sources and remove anything you can't verify.
5. Remove unknown admin users and check for unfamiliar files, especially PHP files in the uploads folder.
6. Update everything and delete unused plugins and themes.
7. Fix the entry point you identified above, or the site will be reinfected.
8. Request a Google review. If Google flagged the site, use the Security Issues report in Search Console to confirm fixes and request a review.

Preventing the next one

• Fewer plugins, all actively maintained.
• Automatic updates for security releases where safe.
• Strong, unique passwords and two-factor login for admins.
• Off-site backups you have actually tested restoring.
• Least-privilege accounts: editors don't need admin.

Another option is to reduce the attack surface altogether. The sites we build at MarketStreet, such as The Knightly Report and IAmSurveyors, run on lightweight custom PHP pages rather than a plugin stack. That is not immune to every attack, since any server still needs updates and good passwords, but it removes the plugin ecosystem as an entry point.

When to get help

Bring in a professional if the site handles payments or customer data, if you can't find the entry point, or if it gets reinfected after cleanup. Payment and personal data incidents may carry legal notification duties, depending on where you operate.

Frequently asked questions

How did my WordPress site get hacked?

Most often through an outdated or vulnerable plugin or theme, a stolen or weak admin password, or a compromised hosting account. Check your plugin versions, admin users and server logs around the date the problem started.

What should I do first if my WordPress site is hacked?

Take a full backup of the hacked site for evidence, change all passwords (WordPress admin, hosting, FTP/SFTP, database), and contact your host. Then clean or restore from a known-good backup.

How do I get the Google hacked warning removed?

After cleaning the site, open the Security Issues report in Google Search Console, confirm the problems are fixed and request a review.

Will restoring a backup fix a hack?

Only if the backup predates the compromise and you also close the entry point. Otherwise the site can be reinfected.

Can a hacked WordPress site affect my Google ranking?

Yes. Google can show warnings in search results and browsers for hacked or harmful content, which cuts clicks until the issue is fixed and reviewed.

Sources

• WordPress.org, FAQ: My site was hacked: wordpress.org
• WordPress Developer Resources, Hardening WordPress: developer.wordpress.org
• Google Search Central, Security Issues report: support.google.com