WordPress site hacked? What to do in the first hour, how to clean it, and what it costs in India

Short answer: If your WordPress site has been hacked, do not delete anything and do not reinstall blindly. Back up the hacked site first, change every password, take the site offline for visitors, then scan and clean the files and database (or restore a clean backup from before the hack), update WordPress, themes and plugins, request a review in Google Search Console if you see a “deceptive site” warning, and finally harden the site so it stays clean. Most hacks are fixable within 24 hours. In India, professional cleanup costs ₹4,999 – ₹25,000 depending on how deep the infection goes; a care plan from ₹999 a month prevents almost all of them.

How to confirm your site is actually hacked

Not every problem is a hack. A white screen after a plugin update, a hosting outage or an expired SSL certificate can look alarming but need a different fix. These are the signs that point to a real compromise:

• Visitors land on another site. Spam redirects to casino, pharmacy or “your device is infected” pages, often only on mobile or only from Google results, so you may not see it yourself.
• Google shows a warning. “Deceptive site ahead”, “This site may be hacked” under your listing, or a Security Issues notice in Search Console.
• Strange pages in search results. Hundreds of Japanese, Vietnamese or pharma product pages under your domain that you never created.
• Unknown admin users in WordPress, or your own admin password no longer works.
• Files changed at odd hours. Modified wp-config.php, .htaccess, index.php, or new PHP files in the uploads folder.
• Hosting or email alerts. Your host suspends the account for malware or outbound spam; customers report spam email from your domain.
• Defaced homepage or pop-ups you never installed.

Quick checks that take two minutes: open your site in an incognito window on your phone via a Google search; search site:yourdomain.com on Google and scan for pages you do not recognise; look at your site in Google Search Console under Security & Manual Actions; run the URL through Google Safe Browsing or VirusTotal.

The first hour: stop the damage before you clean

The order matters. People who start deleting files first often destroy the evidence that tells you how the attacker got in, and the attacker simply comes back through the same door.

1. Back up the hacked site as it is. Files and database, downloaded off the server. You need this to investigate, to recover content, and in case the cleanup goes wrong.
2. Change every password. Hosting control panel, WordPress admin users, FTP or SFTP, database user in wp-config.php, and the email account linked to admin. Use a password manager; attackers reuse leaked passwords.
3. Limit who can reach the site. Enable maintenance mode or password-protect the site at the hosting level so visitors stop hitting malicious redirects and Google stops seeing spam pages. If your host offers it, turn on the web application firewall.
4. Check for extra admin users and API keys. Remove accounts you do not recognise, revoke application passwords, and log out all sessions.
5. Note what you see. Screenshots of the warning, redirect destinations and odd files. This speeds up the professional cleanup if you hand it over.
6. Tell your host. Most Indian hosts (Hostinger, HostGator, BigRock, Cloudways) have a malware scan and can confirm whether other accounts on the same server are affected.

How to clean a hacked WordPress site

You have two routes. Which one is right depends on whether you have a clean backup from before the hack and how comfortable you are with files and databases.

Route A: restore a known-clean backup (fastest if you have one)

1. Find the last backup taken before the first sign of the hack. Check file modification dates to estimate when it started.
2. Restore both files and database to that point, then immediately update WordPress core, every theme and plugin, and PHP if your host still runs 7.x.
3. Change all passwords again after the restore (the old backup contains the old credentials).
4. Re-add any content created after the backup date manually; do not copy it from the hacked database without checking it.
5. Scan the restored site before opening it to visitors.

Route B: manual cleanup (when there is no clean backup)

1. Replace core files. Download the same WordPress version from wordpress.org and overwrite everything except wp-config.php and wp-content.
2. Reinstall themes and plugins from the official source. Delete anything unused and anything nulled or pirated, which is the single most common infection source on Indian SMB sites.
3. Hunt in wp-content and uploads. Look for PHP files inside wp-content/uploads, files with random names, and recently modified files. Compare against a clean copy if you have one.
4. Inspect wp-config.php and .htaccess for injected code and redirect rules. Attackers often add a line that loads a remote script.
5. Clean the database. Search wp_options (siteurl, home, active_plugins), wp_posts and wp_users for scripts, iframes, base64 strings and unknown users.
6. Run a scanner twice. Wordfence or MalCare on the site plus a server-side scan from your host. One tool alone misses backdoors.
7. Rotate secrets. Regenerate the security keys in wp-config.php so every old login cookie dies.

A warning from experience: a site that is “cleaned” but still has one backdoor file will be re-infected within days. If the scanner keeps finding new files after cleanup, the attacker still has a way in and it is time to hand the job to someone who does this daily.

Removing the Google “deceptive site” warning

Once the site is genuinely clean, the warning does not disappear on its own quickly. You have to ask Google to re-check.

1. Open Google Search Console for the site. If it is not verified, verify it now; it takes five minutes.
2. Go to Security & Manual Actions → Security Issues. Google lists the type of problem (malware, deceptive pages, harmful downloads) and sample URLs.
3. Fix every listed URL. Spam pages should return 404 or 410, not redirect to the homepage.
4. Click Request Review and describe what was cleaned and how the site was secured. One or two honest sentences are enough.
5. Reviews usually clear within 1 to 3 days for malware and up to a week for deceptive-content flags. If you were listed by other blocklists (Norton, McAfee, Bitdefender), submit a false-positive request to each.

If Google indexed hundreds of spam pages, use the Removals tool for the worst ones and let the 404s clear the rest over a few weeks. Rankings normally recover once the warning is lifted and the junk pages drop out.

What a hacked website costs to fix in India (2026)

Severity drives the price: a single-plugin infection is at the low end; a site with multiple backdoors, a poisoned database and a Google blacklist is at the high end. Lost sales and a damaged reputation usually cost far more than the cleanup itself.

Why it happened (and how to be sure)

In the hacked sites we clean for Indian businesses, the cause is almost always one of these, in roughly this order:

1. Outdated plugins or themes with a published vulnerability. Many sites run plugins that have not been updated in two years.
2. Nulled or pirated premium themes and plugins. These ship with the backdoor already inside.
3. Weak or reused passwords on admin, hosting or FTP, often the same password used on a leaked site.
4. Shared hosting cross-contamination when another site on the same account is infected.
5. Old PHP versions and abandoned plugins that no longer receive security patches.
6. A previous “cleanup” that missed a backdoor.

To be sure, check the server access logs around the first modified-file timestamp. The request that created the first bad file usually points straight at the vulnerable plugin or the login that was abused.

Hardening so it never happens again

• Update weekly and remove every plugin and theme you do not actively use. Fewer plugins, smaller attack surface.
• Strong unique passwords plus two-factor authentication for every admin. Limit login attempts and rename or protect wp-login.php if your host allows it.
• Web application firewall (Cloudflare free plan or your host’s WAF) in front of the site.
• Daily off-site backups with at least 30 days of retention, and test a restore once.
• Disable file editing in the dashboard and block PHP execution inside the uploads folder.
• Correct file permissions (folders 755, files 644, wp-config.php 600 or 640).
• Keep PHP current (8.2 or newer in 2026) and keep hosting on a provider that patches its servers.
• Monitor. Uptime, file-change and malware monitoring with alerts to a human who will act on them.

Most of this is what a care plan does for you. The website maintenance cost guide breaks down what a plan should include and what it costs; our own plans start at ₹999 a month on the care and maintenance page.

How QTC handles hacked site rescue

FAQ

My WordPress site is hacked. What should I do first?

Back up the hacked site exactly as it is, change every password (hosting, WordPress, FTP, database), and put the site in maintenance mode. Only then start scanning and cleaning, or restore a backup taken before the hack. Deleting files first destroys the evidence of how the attacker got in.

How much does it cost to fix a hacked website in India?

Professional cleanup costs ₹4,999 – ₹25,000 depending on how deep the infection is, and is usually completed within 24 hours. Security plugin subscriptions with cleanup run ₹8,000 – ₹25,000 a year. A monthly care plan from ₹999 prevents most hacks in the first place.

How do I remove the Google “deceptive site ahead” warning?

Clean the site completely first, then open Google Search Console, go to Security Issues, fix every sample URL listed, and click Request Review with a short note on what was cleaned. Reviews usually clear in 1 to 3 days for malware and up to a week for deceptive-content flags.

Can I just reinstall WordPress to remove the malware?

Replacing core files helps but is not enough. Malware usually lives in themes, plugins, the uploads folder and the database, and often leaves a backdoor file. A reinstall without cleaning those and rotating passwords gets re-infected within days.

How did my WordPress site get hacked?

Almost always an outdated plugin or theme with a known vulnerability, a nulled (pirated) theme or plugin that shipped with a backdoor, a weak or reused password, or cross-contamination from another site on the same hosting account. The server access logs around the first modified file usually show the exact entry point.

How do I stop my site getting hacked again?

Update weekly, remove unused plugins and themes, use unique passwords with two-factor login, put a firewall in front of the site, take daily off-site backups, keep PHP current and monitor for file changes. A care plan does all of this for a fixed monthly fee.