What should I do if my WordPress website is hacked?
By Dale Sutton · Updated 27 October 2026
Stay calm and don't start deleting files. Contact your hosting provider, change the passwords for your hosting, WordPress admin and email from a device you trust, and turn on multi-factor sign-in. Then restore a backup from before the problem started, or have the site cleaned, update everything, remove accounts you don't recognise, and check Google Search Console for security warnings.
First steps
In roughly this order:
- Write down what you noticed and when: warnings, strange pages, redirects, emails from your host.
- Contact your hosting provider. Many can tell you what happened and help you contain it.
- From a device you trust, change the passwords for your hosting account, every WordPress admin and the email accounts linked to them.
- Turn on multi-factor sign-in wherever it is offered.
- Don't delete files or reinstall plugins yet. That can destroy the evidence of how the attacker got in.
Cleaning up
- Restore a backup from before the problem started, if you have a clean one, then update everything immediately.
- If there is no clean backup, the site needs cleaning: infected files replaced, unknown code removed, and the database checked.
- Remove any admin users you don't recognise.
- Update WordPress, your theme and every plugin, and delete plugins you no longer use.
- Check Google Search Console for security issues, and request a review once the site is clean.
If customer information was involved
If the site stored customer details, such as enquiries, bookings or orders, check whether those could have been accessed. Some Australian businesses have obligations under the Notifiable Data Breaches scheme, and the Office of the Australian Information Commissioner (OAIC) explains who it applies to and what to do.
Stopping it happening again
Most small business websites are compromised through outdated software, abandoned plugins or old logins, not targeted attacks. Regular updates, removing accounts nobody needs, multi-factor sign-in and backups that are tested by restoring them prevent most repeat problems.
Oria Digital can clean up an affected site as quoted work, then keep it maintained with a Website Protection Plan. Cleaning an existing problem is always quoted separately.
Related questions
Can you guarantee my website will never be hacked or go offline?
No. The service helps reduce avoidable risks, find problems early and improve how ready you are to recover. Third-party services and incidents can still affect a website, so nobody can honestly promise it will never happen.
Do I need to move my website to Oria Digital?
Not necessarily. Your current website and hosting are reviewed first. Where the platform and access allow, the work is done on your existing setup. If a change is needed, you are told why and it is quoted separately.
What happens if you find an existing problem?
You get an explanation of the finding, how urgent it is and the recommended next step. Work outside the agreed check or care plan, such as cleaning up an existing infection or a major upgrade, is quoted separately before anything is done.
Want this applied to your own site? Start with the free audit, or go straight to Website Protection.