A customer messages you to say your website sent them to a gambling site. Or Chrome shows a red warning page, or your hosting company tells you your account has been suspended for sending spam. The natural reaction is fear, followed by hasty moves: deleting folders, reinstalling the theme, or handing the site to anyone who will "take a look".
This guide is for exactly that moment. Follow the steps in this order: confirm the site really has been hacked, stop the damage from spreading, find the root cause and clean up, and finally win back Google's trust. Most of the examples are about a hacked WordPress site, because that is the most common case; but the logic is the same for any website.
How do I know my website has really been hacked?
Most hacks are silent. To a hacker, your site is a source of income: it sends your traffic somewhere else, creates spam pages in Google or sends bulk email from your server. That is why the site owner is sometimes the last to find out.
Your site redirects to another site, but only for some people
The most common sign is visitors being sent to a gambling site, a casino or suspicious ads. The confusing part is that the malicious code is often active only for a specific group: mobile users, people arriving from Google results, or each user's first visit. You, logged in as an admin and typing the address directly, see nothing. To test it, use your phone on mobile data, open a private browser window, search for your site's name in Google and click through from the results.
Japanese or pharma spam pages in Google
Search Google for site:yourdomain.com (with your own domain). If you see pages with Japanese or Chinese titles, or pages selling drugs or counterfeit goods that you did not create, your site is infected with "keyword spam". Sometimes these pages are generated only when Googlebot visits.
Other signs
An unknown administrator user in the dashboard, a "Deceptive site ahead" warning in the browser, a message in the "Security issues" section of Google Search Console, account suspension by your host, your emails bouncing, and .php files in the uploads folder are all common signs.
Table of signs and first actions
This table is for quick diagnosis, not a final verdict; but taking any of these signs seriously does no harm.
| Sign | Likely meaning | First action |
|---|---|---|
| Redirect to a gambling site only on mobile or from Google | Malicious code in the theme, .htaccess or the database |
Take a full copy of the current state, then turn on maintenance mode |
Japanese or pharma pages in site: results |
Keyword spam; fake or dynamically generated pages | Save the list of spam URLs and check Search Console |
| Unknown administrator user | The hacker has full access to the dashboard | Note its creation date and email, then disable it |
| Red browser warning or Security issues | Google has detected malware or phishing | Review the sample URLs in the Search Console report |
| Account suspended by the host | Malicious files or spam sent from your account | Ask the host for an exact report of the files and logs |
| Sudden outgoing spam email | An email-sending script or a leaked email password | Change the passwords of all mailboxes |
.php file in the uploads folder |
Almost always a backdoor | Keep it for investigation and delete it during the cleanup |
The first hour: what to do and what not to do
In the first hour the goal is not to clean up; the goal is to stop the damage from growing and to avoid destroying evidence.
- Do not delete anything in a hurry. Deleting suspicious files or reinstalling WordPress may make the symptom disappear for a few hours, but it does not close the entry point, and it also wipes out the hacker's traces. There are almost always several other backdoors.
- Take a full copy of the current state. Copy all files and the database, in their current infected state, and keep them off the server. This copy is evidence, not a backup to restore from; with it you can find changed files and rescue recent orders or posts. Download the server access logs too, because some hosts keep them for only a few days.
- Change every password: the hosting account and control panel (cPanel or any other panel), all FTP accounts, the database user (and update it in
wp-config.php), all site administrators, the domain's mailboxes and the domain registrar account. Do this from a device you have no reason to suspect is infected. In WordPress, also change the security keys (salts) so that open sessions, including the hacker's, are closed. - Put the site in maintenance mode. A maintenance-mode plugin inside the same infected WordPress install is not always enough, because the malicious code may run first. It is safer to send requests, via the host or
.htaccess, to a static page with a 503 response so Google understands the outage is temporary. - Tell your hosting company. Ask which files they have identified as malicious, how far back their backups go, and whether other sites on the same account are infected too. If your account has been suspended, this is the only way back.
Finding the entry point: the most important step
Cleaning up without finding the way in is like cleaning a house with the door left open. These are the most common entry points:
- Outdated plugins and themes. Most WordPress hacks start with a plugin or theme that has a known vulnerability. Bots automatically scan thousands of sites for that exact version.
- Nulled themes and plugins. This is very common. A copy taken from a "free download" site or with a "pre-activated license" sometimes has a backdoor from day one and never gets official updates. As long as that copy is on the site, cleaning up is effectively pointless.
- Weak or reused passwords. Bots constantly try the WordPress login page with common passwords and passwords leaked from other sites.
- Other sites on the same hosting account. An old test copy or a forgotten site on the same shared hosting brings the infection back to the main site; this is a common reason for repeat hacks.
- Old access. A previous designer's admin account or a freelancer's FTP account that was never closed.
To work out when and how the attacker got in, put file modification dates, the creation dates of unknown users and the access logs side by side. Repeated requests to a particular plugin just before the first malicious file appeared are a good clue.
Website malware removal, step by step
Restore from a clean backup, if you have one
The best case is a copy you are sure was taken before the intrusion. Yesterday's backup probably contains the same infection, because many intrusions happen weeks before any signs appear. After restoring, you still have to close the entry point and update everything. Move orders or content added after the backup date carefully and by hand from the evidence copy.
Compare with the original files
If you do not have a clean backup:
- Replace the
wp-adminandwp-includesfolders and the root files with the official WordPress release of the same version as your site. - Reinstall every plugin and theme from its official source, not from the copy on the server. Remove any nulled copy or replace it with a legitimate one.
- There must be no
.phpfiles at all inwp-content/uploads. - Read
wp-config.phpand every.htaccessfile line by line; malicious redirect code is very often right there.
Backdoors and the database
A backdoor is a file or piece of code that keeps a way in open even after passwords are changed. Encoded code, long meaningless strings and functions such as eval and base64_decode in unexpected places are signs of one; although healthy plugins sometimes use these functions too, which is why manual cleanup takes experience. In the database, look for injected scripts in posts and settings, unknown users, and scheduled tasks (cron) that reinstall the malware.
Update and test again
Bring the core, plugins, theme and PHP version up to the latest stable release, and delete unused plugins, not just deactivate them. Then repeat the first test: on a phone, from Google results, in a private window.
If you have no clean backup: the honest answer
If there is no clean backup at all, nobody can say with complete certainty that the site is fully clean. Manual cleanup removes the known signs, but there is always a chance that a well-hidden backdoor gets left behind and becomes active weeks later. Anyone who promises a "guaranteed cleanup" without a clean backup is promising more than they know.
Sometimes rebuilding makes more sense than cleaning up: when the site is built on a nulled theme with a lot of custom code, has been hacked several times in a row, runs software so old that updating it effectively means rewriting it, or needed a design overhaul anyway. In that case, the content, images and product data are reviewed and moved to a fresh site, and the old code is retired. Our guide to website redesign and our comparison of WordPress vs custom development help with this decision. The cost of a rebuild depends on the scope of work; for a first estimate, use the cost calculator.
Winning back Google's trust
Request a review in Search Console
If a warning has been recorded in the Search Console Security issues report, click Request Review once every problem has been fixed on every page. Write briefly what the problem was, what you did (entry point, deleted files, updates) and what the result was. According to Google's guidance, the review can take from several days to several weeks. Requesting a review too early, while the site is still infected, only delays things.
Dealing with spam URLs in the results
- Make sure the spam URLs now return a 404 or, better, a 410 code. A 410 says more clearly that the page has been removed permanently.
- Do not redirect them to the home page; that ties the spam to your healthy pages.
- For a page that must leave the results immediately, the Search Console Removals tool hides it temporarily; it does not replace a 404 or 410.
- Remove fake sitemaps and unknown owners from Search Console.
Check again a few days later
For a few weeks, run site: every few days, enter the site from mobile and from Google results, and check the list of admin users and new files. If the signs come back, something was left behind. More technical detail is in Google's guide to hacked sites, and to review your site's SEO after the crisis, our SEO checklist is a good starting point.
Prevention: make sure it does not happen again
A site whose cause of hacking is not fixed usually gets hacked again. These habits seriously reduce the chance of an intrusion, although none of them creates absolute security:
- Regular updates to the core, plugins, theme and PHP.
- Delete unused plugins and themes; a deactivated plugin is still on the server.
- Never use nulled themes or plugins; a legitimate license is almost always cheaper than a cleanup.
- Two-factor authentication (2FA) for site administrators, the hosting panel and email.
- Least privilege: everyone gets only the role they need; close former colleagues' access immediately.
- Off-server backups with several older versions, and restore tests every so often. A backup that has never been restored is only a hope.
- A web application firewall (WAF) at the host or CDN level, or a reputable security plugin.
- Monitoring: periodic file scans, Search Console email alerts and a regular look at the user list.
- Separate your sites: do not keep test copies and old projects next to the main site.
We cover the routine tasks in detail in the WordPress maintenance checklist, and choosing the right host in the domain and hosting guide.
When should you hand the job to a specialist?
If your site is simple, you have a clean backup and you are comfortable working with files and databases, you can do most of these steps yourself. But when it is an online store and customer data is at risk, you have no clean backup, the site was reinfected after a cleanup, or Google has issued a warning and traffic has dropped, getting help makes more sense.
When choosing someone, ask how they find the entry point, whether they keep an evidence copy of the current state, and what report they give you after the work. Be cautious about anyone who offers a "guarantee" without having seen the site.
Summary
With a hacked website, the order of the work matters more than speed: confirm the sign, take an evidence copy, change every password and put the site in maintenance mode. Then find the entry point, clean up using a clean backup or by comparing with the original files, and update everything. Finally, request a review from Google and stay watchful for a few weeks.
A practical next step: today, check when your last off-server backup was taken and whether you have tested restoring it. If you want someone to take on cleanup, updates and regular monitoring of your site under a written scope of work, see our website care & maintenance services. At MyTarh, support starts with an initial technical and security review, and hacked website recovery is free for subscribers to the Pro and Complete packages.
Frequently asked questions
My website has been hacked: what should I do first?
Before any cleanup, take a full copy of all files and the database in their infected state and keep it separately. Then, from a clean device, change the passwords for the host, control panel, FTP, database, site administrators and email, put the site in maintenance mode and tell your host. Hastily deleting files destroys evidence and does not close the entry point.
Why does my site redirect to a gambling site only on mobile?
Much malicious code is deliberately active only for a specific group: mobile users, people coming from Google results, or each user's first visit. An admin who is logged in to the dashboard or types the address directly sees nothing. This is a sign of a real infection, not a phone glitch; the code is usually hidden in .htaccess, the theme files or the database.
How long does it take for Google's Deceptive site warning to be removed?
After a full cleanup, you need to send a review request from the Security issues report in Google Search Console. According to Google itself, the review can take from several days to several weeks. If the site is still infected, the request is rejected and more time is lost; so before requesting, test the pages again from mobile and from Google results.
Does a security plugin clean the site on its own?
Scanning plugins are useful for finding known malware, but they do not replace a manual review. They do not always recognize new or well-hidden malware, and they do not close the entry point themselves. On an infected site, the malicious code may run before the plugin does. It is better to use one as a supporting tool and for monitoring after the cleanup.
What should I do about Japanese spam pages indexed in Google?
First make sure those pages have been removed from the server and return a 404 or 410 code, not a redirect to the home page. Also remove fake sitemaps and unknown owners from Search Console. As Google recrawls, it gradually drops these URLs from the results. For urgent cases, the Search Console Removals tool hides them temporarily.
Is it better to clean up or rebuild the site?
If you have a clean backup and the entry point is known, cleaning up is usually enough. But if the site is built on a nulled theme, has been hacked several times in a row, or runs very old software, rebuilding and moving reviewed content across is sometimes both safer and cheaper in the long run. Without a clean backup, no cleanup can be fully guaranteed.