# Clean a hacked website on hosting > Recover a hacked website: note the signs, lock the attacker out, restore a clean backup or replace infected files, remove backdoors and ask Google for a review. Difficulty: Intermediate Signs of a hacked site include redirects to unknown pages, new administrator accounts you did not create, files you do not recognise, a browser or search engine warning, or a sudden flood of outgoing email. This guide takes you through recovery on web hosting, with extra steps for WordPress. ## Before you start - Open a ticket and tell us what you see. We can check the server side and help you with backups. - Do not start by deleting files at random. Work through the steps in order. ## Step 1: Write down what you see Note what made you suspect a hack, when you first noticed it (with time zone) and what changed recently: a new plugin, a theme change, a new user. This record helps us, you and anyone you hire to find the cause. ## Step 2: Keep a copy of the current state Download a full copy of the files and the database as they are now; see [back up and restore your hosting account](/guides/hosting-backup-restore). Label it clearly as infected. It is for reference only: never restore it later. ## Step 3: Lock the attacker out Change every password that gives access to the site, with long, unique passwords: - the control panel (and your client area account, if it shares the password), - every FTP and SFTP account, - the database user (and put the new password in the site's configuration, such as `wp-config.php`), - every administrator of the application, and remove users you do not know. For WordPress, also replace the secret keys in `wp-config.php` with a new set from the [WordPress key generator](https://api.wordpress.org/secret-key/1.1/salt/). This signs out everyone who is still logged in. > **Warning** > > Scan your own computer with an up-to-date antivirus as well. Malware on a computer can steal panel, FTP and WordPress passwords as you type them. ## Step 4: Restore a clean backup, or rebuild in place **Restore a backup** Use a backup from before the first sign of the hack: hacks are often noticed days after they happen. Restore the files and the database (see [back up and restore your hosting account](/guides/hosting-backup-restore) or open a ticket), then continue with step 6 straight away: the hole the attacker used is still open. **Rebuild in place (WordPress)** 1. Note the WordPress version, then replace the folders `wp-admin` and `wp-includes` with fresh copies of the **same version** from wordpress.org, over SFTP. Do not use the reinstall button in the dashboard: it overwrites files but leaves added ones. 2. Delete plugins and themes you do not use. Reinstall the others from the WordPress.org directory or the vendor's site. 3. Look for PHP files in `wp-content/uploads`; uploads should hold media, not code. 4. Check `.htaccess` in the root and in subfolders, and the files `index.php`, `wp-config.php` and the theme's `header.php`, `footer.php` and `functions.php` for code you did not write. 5. Under **Users**, remove administrators you do not know. For other applications, replace the code with a clean copy from your own repository or the vendor, and keep only your content and configuration. ## Step 5: Check with WP-CLI (if your plan has SSH) If you can sign in over SSH and WP-CLI is available, compare the files with WordPress.org's checksums: ```bash wp core verify-checksums wp plugin verify-checksums --all ``` **Verify:** the core check ends with `Success: WordPress installation verifies against checksums.` Plugins that are not hosted on WordPress.org cannot be checked this way; reinstall them from the vendor. ## Step 6: Close the hole 1. Update the application, every plugin and every theme to the newest version. 2. Change all passwords from step 3 **again**, now that the site is clean. 3. Look at your scheduled tasks (**Cron Jobs** in cPanel, **Scheduled Tasks** in Plesk) and remove any you did not create. 4. Apply the hardening steps in [secure a WordPress site](/guides/secure-wordpress-site). ## Step 7: Ask Google to review the site If Google shows a warning for your site, open **Google Search Console**, then the **Security issues** report. Check that the example addresses it lists are clean, then select **Request a review** and describe what you removed and what you fixed. Google says a review can take from a few days to a few weeks. ## Troubleshooting **The hack comes back after a few days.** A backdoor is still in place, a stolen password still works, a scheduled task re-installs it, or the vulnerable plugin was not updated. Repeat steps 3 to 6 and open a ticket. **Your emails are rejected or end up in spam.** The site may have been used to send spam. Clean the site first, then see [email deliverability](/guides/email-deliverability). **You cannot sign in to WordPress any more.** Use **Lost your password?** on the login page. If the attacker changed your email address, ask us in a ticket to help you reset the account through the database. ## Next steps - Keep it from happening again: [secure a WordPress site](/guides/secure-wordpress-site). - Make sure you always have a clean copy: [back up and restore your hosting account](/guides/hosting-backup-restore). ## Frequently asked questions ### Can I just delete the files that look wrong? Rarely enough. Attackers usually leave more than one backdoor and keep the passwords they stole. Change every access and replace the code from trusted sources, or the site is hacked again within days. ### Should I restore a backup? Yes, if you have one from before the hack. Hacks are often noticed days later, so pick a copy from before the first sign. After the restore, update and change passwords at once, or the same hole is used again. ### My site shows a Google warning. How long until it is gone? After you clean the site, request a review in Google Search Console. Google says a review can take from a few days to a few weeks. ### Can you clean the site for us? Open a ticket as soon as you notice a hack. We check the server side, tell you what we see and help you restore a backup. --- Source: \ Updated: 2026-10-15