--- title: "WordPress security and hacked sites | WP Ministry" url: https://wpministry.co/topics/wordpress-security/ description: "How to tell whether a WordPress site has been broken into, what to do in the first hour, how to clean it, and how to close the ways in." lang: en-US --- Skip to content # WordPress security and hacked sites How to tell whether a WordPress site has been broken into, what to do in the first hour, how to clean it, and how to close the ways in so that it does not happen again. By WP Ministry Published October 7, 2026 There are two kinds of security work, and which one you need depends on what you are looking at. **Something looks wrong now.** Do not delete anything yet. Check whether the site has been hacked (https://wpministry.co/blog/check-wordpress-site-hacked/), or run the check from outside (https://wpministry.co/tools/wordpress-hacked-site-check/), which reads the site as a stranger is served it. If a check comes back positive, follow the first-hour runbook (https://wpministry.co/resources/hacked-wordpress-site-runbook/), then the full cleanup (https://wpministry.co/blog/remove-malware-hacked-wordpress-site/). If you already know what you are looking at, go straight to it: visitors sent to another site (https://wpministry.co/blog/wordpress-redirecting-to-another-site/), a red warning in the browser (https://wpministry.co/blog/deceptive-site-ahead-wordpress/), spam pages under your name in Google (https://wpministry.co/blog/wordpress-spam-pages-in-google/), an administrator nobody created (https://wpministry.co/blog/unknown-admin-user-wordpress/), a hosting account suspended for malware (https://wpministry.co/blog/hosting-account-suspended-malware/), or malware that comes back after every cleanup (https://wpministry.co/blog/wordpress-site-keeps-getting-hacked/). **Nothing is wrong and you want to keep it that way.** The security guide (https://wpministry.co/blog/ultimate-wordpress-security-guide/) puts the work in order of what it prevents. The measures that stop the most for the least effort are two-factor sign-in (https://wpministry.co/blog/set-up-two-factor-authentication-wordpress/), limits on password guessing (https://wpministry.co/blog/protect-wordpress-brute-force-attacks/), correct file permissions (https://wpministry.co/blog/wordpress-file-permissions-guide/), and updates applied safely (https://wpministry.co/blog/how-to-safely-update-wordpress/) and on time. An audit (https://wpministry.co/blog/audit-wordpress-site-security-vulnerabilities/) tells you where a particular site stands. If you are getting quotes for a cleanup, what malware removal costs (https://wpministry.co/cost/wordpress-malware-removal/) says how cleanup is sold and what a complete one includes. If you would rather hand it over, malware removal (https://wpministry.co/services/malware-removal/) is a one-time clean-up with hardening, a blacklist removal request and a written report, and the security service (https://wpministry.co/services/wordpress-security/) is the upkeep that follows. ## Guides - "Deceptive site ahead" on a WordPress site: what the red warning means and how to get it lifted The red full-page warning comes from Google Safe Browsing, which most browsers consult. Google found phishing, malware or unwanted software on your site or loaded by it. The warning goes only after the cause is removed and Google has reviewed the site.: https://wpministry.co/blog/deceptive-site-ahead-wordpress/ - GDPR and WordPress: what the site collects and what to set up A WordPress site collects personal data through comments, forms, accounts, orders, tags from other companies and its server logs. WordPress has a privacy policy page, an export tool and an erase tool. The rest is an inventory, a reason for each thing kept, consent and retention.: https://wpministry.co/blog/set-up-wordpress-gdpr-compliance/ - Hosting account suspended for malware: how to get your WordPress site back A host suspends an account to stop a hacked site harming others, and restores it when you show the cause is gone. Ask the host for three things. They are the list of what it found, access to the files and the database, and the steps of its review.: https://wpministry.co/blog/hosting-account-suspended-malware/ - How to add security headers to a WordPress site Security headers are lines a server sends with each page that tell the browser how to treat it. Add X-Content-Type-Options, Referrer-Policy and a frame rule first, then HSTS with a short max-age, and Content-Security-Policy last, in report-only mode.: https://wpministry.co/blog/set-up-wordpress-security-headers/ - How to audit a WordPress site for security weaknesses A security audit is a written inventory of a working site. It covers what is installed, who can log in, how the site is configured, what it shows from outside, whether a backup restores, and who holds the hosting and domain logins. Each finding gets a date to fix it or a reason to accept it.: https://wpministry.co/blog/audit-wordpress-site-security-vulnerabilities/ - How to change the WordPress login URL, and what it does and does not protect WordPress has no setting for its login address, so a plugin moves it. That cuts down automated requests to wp-login.php. It does not make a password harder to guess, and xmlrpc.php stays where it is. Save the new address before you log out.: https://wpministry.co/blog/change-wordpress-login-url/ - How to check whether your WordPress site has been hacked Check from outside first, with Google's Security issues report, its Safe Browsing page, a site search and the page as Google is served it. Then check inside, from administrators and checksums to uploads and the access log. Clean results lower the odds and do not prove the site is clean.: https://wpministry.co/blog/check-wordpress-site-hacked/ - How to disable XML-RPC in WordPress, and when to leave it on xmlrpc.php lets outside programs reach WordPress, and Jetpack and the mobile apps still use it. If nothing on your site does, switch off its login methods with a filter, remove its pingback methods, or refuse the file at the web server. Check the access log first.: https://wpministry.co/blog/disable-xml-rpc-wordpress/ - How to install a free SSL certificate on WordPress and move the site to HTTPS Get a free certificate from your host's control panel, or with Certbot on a server you run yourself. Check that the https address works, change WordPress's two addresses to https, redirect http with a 301, then clear what is left over.: https://wpministry.co/blog/install-free-ssl-certificate-wordpress/ - How to protect WordPress from brute force attacks A brute force attack is a program trying one password after another on your login page or on xmlrpc.php. Strong unique passwords and two-factor login make the guessing fail. Login limits, a firewall and server rules cut down how much of it reaches the site.: https://wpministry.co/blog/protect-wordpress-brute-force-attacks/ - How to remove malware from a hacked WordPress site Take the site offline, keep a copy of it as it is, and change every password and the secret keys. Then restore a backup from before the break-in, or replace WordPress and every plugin with clean copies and check what is left. Finish by finding and closing the way in.: https://wpministry.co/blog/remove-malware-hacked-wordpress-site/ - How to set up two-factor authentication in WordPress Install the Two Factor plugin, turn on an authenticator app and backup codes in your profile, and test the login before you close the window you are in. Keep the backup codes away from your phone. They are how you get back in when the phone is lost.: https://wpministry.co/blog/set-up-two-factor-authentication-wordpress/ - Is it safe to give someone admin access to your WordPress site? It is as safe as the person, because an Administrator can do anything on the site. Never share your own login. Add a user in their name, let WordPress email them a link to set their own password, and delete the user when the work is done.: https://wpministry.co/blog/is-it-safe-to-give-wordpress-admin-access/ - The EU Cyber Resilience Act and WordPress: who it applies to and when The Cyber Resilience Act puts its duties on those who supply software on the EU market in the course of a commercial activity, not on a site owner who only uses WordPress. Reporting duties for manufacturers began on 11 September 2026. The rest applies from 11 December 2027.: https://wpministry.co/blog/wordpress-eu-cyber-resilience-act-guide/ - The Japanese keyword hack on WordPress: spam pages in Google and how to get them out Someone has added pages to your site, or made it answer Google differently than it answers people, to sell links and traffic. Clean the site until every spam address answers 404. Then clear Google's index with the Removals tool, a clean sitemap and a review. They are two separate jobs.: https://wpministry.co/blog/wordpress-spam-pages-in-google/ - Unknown admin user in WordPress: what it means and how to remove it properly An administrator nobody created means someone had the power to make one. Deleting it removes the symptom and leaves the way in. Rule out the innocent explanations, list every account from the database, record what you find, then remove it while you close the hole.: https://wpministry.co/blog/unknown-admin-user-wordpress/ - Why your WordPress site keeps getting hacked, and what finally stops it A WordPress site that is reinfected was either never fully cleaned or is still open the way it was first entered. There are eight reasons, and each one can be checked. A rebuild from clean sources, then new credentials, then updates, deals with them in order.: https://wpministry.co/blog/wordpress-site-keeps-getting-hacked/ - WordPress file permissions: what the numbers mean and what to set WordPress's own guidance is 755 for folders, 644 for files and 440 or 400 for wp-config.php, with every file owned by your hosting account. Nothing should be 777. Who owns the files matters as much as the numbers.: https://wpministry.co/blog/wordpress-file-permissions-guide/ - WordPress firewalls compared: plugin, DNS-level or host, and how to choose A WordPress firewall is a plugin on your server, a service that sits in front of your site, or a filter your host runs. Where it sits decides what it can stop and what it costs to set up. Choose the place first, then the product.: https://wpministry.co/blog/best-wordpress-firewall-plugins/ - WordPress search results pages (/?s=) in Google and Search Console: what they are and what to do An address with ?s= or /search/ in it is your site's own search page, asked for with someone else's words. WordPress puts noindex on every search page, so Google reads it and leaves it out. Check that your site prints the tag. Nothing was added to the site.: https://wpministry.co/blog/wordpress-search-pages-in-google/ - WordPress security plugins compared: what each one does and how to choose A security plugin scans for malware, guards the login page, switches on hardening settings, filters requests and keeps a log. It does not replace updates, backups or good passwords. Choose by where it does its work and by what its free version leaves out, and run only one.: https://wpministry.co/blog/best-wordpress-security-plugins/ - WordPress security: what to do, in order of what matters most Keep WordPress, plugins and themes updated, give every account a strong unique password and two-factor login, and keep a backup you have restored at least once. Those three do most of the work. Roles, HTTPS, file hardening and a firewall come after them.: https://wpministry.co/blog/ultimate-wordpress-security-guide/ - WordPress site redirecting to another site: how to tell a hack from a setting, and what to do first A redirect to a site you did not choose is a sign of a hacked WordPress, but a redirect rule, the site address settings, an expired domain or the visitor's own device can look the same. Check what a visitor is served, look where redirects are planted, and delete nothing until you have a copy.: https://wpministry.co/blog/wordpress-redirecting-to-another-site/ ## What it costs - What WordPress malware removal costs: how it is priced and what a cleanup should include A WordPress malware cleanup is priced by how it is sold (a fixed fee, an hourly rate or a subscription) and by what counts as clean. Compare quotes on scope. Check that the way in is found and closed, and that a review request, a written report and a guarantee are included.: https://wpministry.co/cost/wordpress-malware-removal/ ## Runbooks and checklists - Hacked WordPress site: a runbook for the first hour What to do in the first hour after you find your WordPress site has been hacked, in order. Write down what you see, protect visitors, keep a copy of the site as it is, lock the attacker out and tell the people who need to know. Cleaning comes after.: https://wpministry.co/resources/hacked-wordpress-site-runbook/ ## Terms - Application password An application password lets a program reach a WordPress site as one user, through the REST API or XML-RPC, without that user's main password. It does not work on the login screen. Each one is made and revoked on the user's profile, and the feature needs HTTPS.: https://wpministry.co/glossary/application-password/ - Backdoor A backdoor is a way back into a site that an attacker leaves behind, so that they can return without the login and without the hole they first used. It is why a WordPress site that was cleaned gets infected again.: https://wpministry.co/glossary/backdoor/ - Brute force attack A brute force attack is a program trying one username and password after another until one works. On WordPress it is aimed at wp-login.php and xmlrpc.php. Failed attempts in a log are not a break-in, but enough of them can slow a site down.: https://wpministry.co/glossary/brute-force-attack/ - Checksum A checksum is a short string worked out from a file's contents. If the file changes, so does the string. WordPress.org publishes one for every file in WordPress and in its plugins, so a site's files can be compared with the originals.: https://wpministry.co/glossary/checksum/ - Malware Malware is software written to do harm. On a WordPress site it is code someone planted to send visitors elsewhere, publish spam pages, take what people type or keep a way back in. A warning or a scan result is a reason to check, not proof either way.: https://wpministry.co/glossary/malware/ - Nonce A WordPress nonce is a short token in a form or a link that shows the request came from a page WordPress built for you. Despite the name, it is not used once. It lasts between 12 and 24 hours, and when one fails you see "The link you followed has expired.": https://wpministry.co/glossary/nonce/ - Salts and security keys WordPress salts and security keys are eight long random strings in wp-config.php. WordPress uses them to make the login cookies and form tokens it hands out. Replace them and everyone who is logged in has to log in again.: https://wpministry.co/glossary/salts-and-security-keys/ - SSL certificate An SSL certificate is a file on your web server that lets browsers open an encrypted https connection and check that they reached your domain. The protocol is now called TLS, and the name SSL stayed. It proves control of a domain, not who runs the site.: https://wpministry.co/glossary/ssl-certificate/ - Two-factor authentication (2FA) Two-factor authentication asks for a second proof after the password, usually a code from an app on your phone. WordPress does not include it, so a plugin adds it. A recovery code is a spare that works once, for the day the phone is not there.: https://wpministry.co/glossary/two-factor-authentication/ - Web application firewall (WAF) A web application firewall reads each request sent to a website and refuses the ones that match its rules for known attacks. It can run inside WordPress as a plugin, on the web server, or in front of the site. Where it sits decides what it can stop.: https://wpministry.co/glossary/web-application-firewall/ - XML-RPC XML-RPC is an older way for outside programs to work with a WordPress site, through the file xmlrpc.php. Jetpack and the mobile apps still use it. Its calls that need a login carry a username and password, which makes the file a target for password guessing.: https://wpministry.co/glossary/xml-rpc/ ## Tools - WordPress site health check Give your site's address and see what one page shows a visitor: whether it answers, how it is secured, what search engines are told, and which WordPress, theme and plugins it shows.: https://wpministry.co/tools/wordpress-site-health-check/ - Is my WordPress site hacked? A check from outside Give your site's address and see the signs of a break-in that show from outside: visitors from search sent somewhere else, links hidden in the page, code written to hide what it does.: https://wpministry.co/tools/wordpress-hacked-site-check/ - WordPress salt and security key generator Eight fresh keys and salts for wp-config.php, made in your browser. They are never sent anywhere.: https://wpministry.co/tools/wordpress-salt-generator/ - .htaccess generator for WordPress Choose what you want the server to do and get a complete .htaccess: WordPress's own block, with redirects, closed files, headers and compression above it. Built in your browser.: https://wpministry.co/tools/htaccess-generator/ - WordPress and PHP end-of-life dates: check your version See whether your PHP and WordPress versions still get security fixes, and until when, from php.net's and WordPress.org's own records.: https://wpministry.co/tools/wordpress-php-end-of-life-checker/ ## Malware removal, done for you Malware removal is $99. Full clean-up, hardening, blacklist removal request and a written report. 30-day re-clean guarantee. More about this work: WordPress malware removal (https://wpministry.co/services/malware-removal/) May we measure how this site is used? A yes notes the pages of this visit and loads Google Analytics. A no keeps and loads nothing. See the cookies page (https://wpministry.co/legal/cookies/). If you say yes, we note the pages you look at during this visit and load Google Analytics. If you say no, nothing is kept and nothing is loaded. The site works the same either way. The cookies page (https://wpministry.co/legal/cookies/) has the details. ## Structured data ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://wpministry.co/#organization", "name": "WP Ministry", "url": "https://wpministry.co/", "logo": "https://wpministry.co/brand/logo.png", "address": { "@type": "PostalAddress", "streetAddress": "1309 Coffeen Ave STE 1200", "addressLocality": "Sheridan", "addressRegion": "WY", "postalCode": "82801", "addressCountry": "US" }, "sameAs": [ "https://www.linkedin.com/company/wp-ministry/", "https://x.com/wpministryco", "https://www.instagram.com/wpministryco/", "https://www.facebook.com/wpministryco", "https://www.tiktok.com/@wpministryco", "https://www.pinterest.com/wpministryco/", "https://www.youtube.com/channel/UCOZRuAukk5QSTRPG6BaHl3Q" ] }, { "@type": "WebSite", "@id": "https://wpministry.co/#website", "name": "WP Ministry", "url": "https://wpministry.co/", "inLanguage": "en-US", "publisher": { "@id": "https://wpministry.co/#organization" } }, { "@type": "CollectionPage", "@id": "https://wpministry.co/topics/wordpress-security/#webpage", "name": "WordPress security and hacked sites", "description": "How to tell whether a WordPress site has been broken into, what to do in the first hour, how to clean it, and how to close the ways in.", "url": "https://wpministry.co/topics/wordpress-security/", "inLanguage": "en-US", "isPartOf": { "@id": "https://wpministry.co/#website" }, "publisher": { "@id": "https://wpministry.co/#organization" }, "mainEntity": { "@type": "ItemList", "numberOfItems": 41, "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "\"Deceptive site ahead\" on a WordPress site: what the red warning means and how to get it lifted", "url": "https://wpministry.co/blog/deceptive-site-ahead-wordpress/" }, { "@type": "ListItem", "position": 2, "name": "GDPR and WordPress: what the site collects and what to set up", "url": "https://wpministry.co/blog/set-up-wordpress-gdpr-compliance/" }, { "@type": "ListItem", "position": 3, "name": "Hosting account suspended for malware: how to get your WordPress site back", "url": "https://wpministry.co/blog/hosting-account-suspended-malware/" }, { "@type": "ListItem", "position": 4, "name": "How to add security headers to a WordPress site", "url": "https://wpministry.co/blog/set-up-wordpress-security-headers/" }, { "@type": "ListItem", "position": 5, "name": "How to audit a WordPress site for security weaknesses", "url": "https://wpministry.co/blog/audit-wordpress-site-security-vulnerabilities/" }, { "@type": "ListItem", "position": 6, "name": "How to change the WordPress login URL, and what it does and does not protect", "url": "https://wpministry.co/blog/change-wordpress-login-url/" }, { "@type": "ListItem", "position": 7, "name": "How to check whether your WordPress site has been hacked", "url": "https://wpministry.co/blog/check-wordpress-site-hacked/" }, { "@type": "ListItem", "position": 8, "name": "How to disable XML-RPC in WordPress, and when to leave it on", "url": "https://wpministry.co/blog/disable-xml-rpc-wordpress/" }, { "@type": "ListItem", "position": 9, "name": "How to install a free SSL certificate on WordPress and move the site to HTTPS", "url": "https://wpministry.co/blog/install-free-ssl-certificate-wordpress/" }, { "@type": "ListItem", "position": 10, "name": "How to protect WordPress from brute force attacks", "url": "https://wpministry.co/blog/protect-wordpress-brute-force-attacks/" }, { "@type": "ListItem", "position": 11, "name": "How to remove malware from a hacked WordPress site", "url": "https://wpministry.co/blog/remove-malware-hacked-wordpress-site/" }, { "@type": "ListItem", "position": 12, "name": "How to set up two-factor authentication in WordPress", "url": "https://wpministry.co/blog/set-up-two-factor-authentication-wordpress/" }, { "@type": "ListItem", "position": 13, "name": "Is it safe to give someone admin access to your WordPress site?", "url": "https://wpministry.co/blog/is-it-safe-to-give-wordpress-admin-access/" }, { "@type": "ListItem", "position": 14, "name": "The EU Cyber Resilience Act and WordPress: who it applies to and when", "url": "https://wpministry.co/blog/wordpress-eu-cyber-resilience-act-guide/" }, { "@type": "ListItem", "position": 15, "name": "The Japanese keyword hack on WordPress: spam pages in Google and how to get them out", "url": "https://wpministry.co/blog/wordpress-spam-pages-in-google/" }, { "@type": "ListItem", "position": 16, "name": "Unknown admin user in WordPress: what it means and how to remove it properly", "url": "https://wpministry.co/blog/unknown-admin-user-wordpress/" }, { "@type": "ListItem", "position": 17, "name": "Why your WordPress site keeps getting hacked, and what finally stops it", "url": "https://wpministry.co/blog/wordpress-site-keeps-getting-hacked/" }, { "@type": "ListItem", "position": 18, "name": "WordPress file permissions: what the numbers mean and what to set", "url": "https://wpministry.co/blog/wordpress-file-permissions-guide/" }, { "@type": "ListItem", "position": 19, "name": "WordPress firewalls compared: plugin, DNS-level or host, and how to choose", "url": "https://wpministry.co/blog/best-wordpress-firewall-plugins/" }, { "@type": "ListItem", "position": 20, "name": "WordPress search results pages (/?s=) in Google and Search Console: what they are and what to do", "url": "https://wpministry.co/blog/wordpress-search-pages-in-google/" }, { "@type": "ListItem", "position": 21, "name": "WordPress security plugins compared: what each one does and how to choose", "url": "https://wpministry.co/blog/best-wordpress-security-plugins/" }, { "@type": "ListItem", "position": 22, "name": "WordPress security: what to do, in order of what matters most", "url": "https://wpministry.co/blog/ultimate-wordpress-security-guide/" }, { "@type": "ListItem", "position": 23, "name": "WordPress site redirecting to another site: how to tell a hack from a setting, and what to do first", "url": "https://wpministry.co/blog/wordpress-redirecting-to-another-site/" }, { "@type": "ListItem", "position": 24, "name": "What WordPress malware removal costs: how it is priced and what a cleanup should include", "url": "https://wpministry.co/cost/wordpress-malware-removal/" }, { "@type": "ListItem", "position": 25, "name": "Hacked WordPress site: a runbook for the first hour", "url": "https://wpministry.co/resources/hacked-wordpress-site-runbook/" }, { "@type": "ListItem", "position": 26, "name": "Application password", "url": "https://wpministry.co/glossary/application-password/" }, { "@type": "ListItem", "position": 27, "name": "Backdoor", "url": "https://wpministry.co/glossary/backdoor/" }, { "@type": "ListItem", "position": 28, "name": "Brute force attack", "url": "https://wpministry.co/glossary/brute-force-attack/" }, { "@type": "ListItem", "position": 29, "name": "Checksum", "url": "https://wpministry.co/glossary/checksum/" }, { "@type": "ListItem", "position": 30, "name": "Malware", "url": "https://wpministry.co/glossary/malware/" }, { "@type": "ListItem", "position": 31, "name": "Nonce", "url": "https://wpministry.co/glossary/nonce/" }, { "@type": "ListItem", "position": 32, "name": "Salts and security keys", "url": "https://wpministry.co/glossary/salts-and-security-keys/" }, { "@type": "ListItem", "position": 33, "name": "SSL certificate", "url": "https://wpministry.co/glossary/ssl-certificate/" }, { "@type": "ListItem", "position": 34, "name": "Two-factor authentication (2FA)", "url": "https://wpministry.co/glossary/two-factor-authentication/" }, { "@type": "ListItem", "position": 35, "name": "Web application firewall (WAF)", "url": "https://wpministry.co/glossary/web-application-firewall/" }, { "@type": "ListItem", "position": 36, "name": "XML-RPC", "url": "https://wpministry.co/glossary/xml-rpc/" }, { "@type": "ListItem", "position": 37, "name": "WordPress site health check", "url": "https://wpministry.co/tools/wordpress-site-health-check/" }, { "@type": "ListItem", "position": 38, "name": "Is my WordPress site hacked? A check from outside", "url": "https://wpministry.co/tools/wordpress-hacked-site-check/" }, { "@type": "ListItem", "position": 39, "name": "WordPress salt and security key generator", "url": "https://wpministry.co/tools/wordpress-salt-generator/" }, { "@type": "ListItem", "position": 40, "name": ".htaccess generator for WordPress", "url": "https://wpministry.co/tools/htaccess-generator/" }, { "@type": "ListItem", "position": 41, "name": "WordPress and PHP end-of-life dates: check your version", "url": "https://wpministry.co/tools/wordpress-php-end-of-life-checker/" } ] } }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://wpministry.co/" }, { "@type": "ListItem", "position": 2, "name": "Topics", "item": "https://wpministry.co/topics/" }, { "@type": "ListItem", "position": 3, "name": "WordPress security and hacked sites" } ] } ] } ```