Should I just restore a backup?

Only if you know when the compromise started, and usually you do not. Attackers often sit quietly for weeks, so a recent backup may already contain their backdoor. Restoring also leaves the original vulnerability in place. Backups are part of recovery, not the whole of it.

Most commonly an out-of-date plugin or theme with a publicly known vulnerability, a weak or reused administrator password, or a compromised hosting account. These attacks are usually automated: scanners find the vulnerable version and exploit it without anyone choosing your site specifically.

How long until Google removes the warning?

Once the site is genuinely clean, a review request through Search Console usually clears within days. A request submitted while remnants remain tends to fail, which costs more time than cleaning properly the first time.

Your WordPress Site Was Hacked: The First 24 Hours

Spam in your search results, a red browser warning, or redirects you didn't set up. Here's what to do in the first day — in the right order — so the site gets cleaned once, not three times.

Published October 25, 2026 3 min read

The signs are usually one of three: a red warning in visitors’ browsers, spam keywords showing up under your site in Google, or visitors being redirected somewhere you never set up. However it appears, the first day decides whether the site gets cleaned once or keeps getting reinfected.

Hour one: preserve, don’t panic-delete

Take a full copy of the site as it is now — files and database — before changing anything. It feels backwards, but that copy is your evidence. Without it, you can’t find out how they got in or what they touched.

Don’t start deleting suspicious files yet. You’ll destroy the trail, and you’ll almost certainly miss some.

Hours one to four: contain

Change every password: WordPress administrators, hosting control panel, database, FTP/SFTP, and the email account tied to the domain.
Check for administrator accounts you didn’t create, and remove them.
Put the site into maintenance mode if it’s actively attacking visitors, so you’re not serving malware while you work.

Hours four to twelve: find the entry point

This is the step most quick-fix services skip, and it’s why sites get reinfected within weeks.

Compare files against clean copies of WordPress core, themes and plugins to see exactly what changed.
Look at access logs around the time things started going wrong.
List every plugin and theme with its version, and check each against known vulnerabilities. Abandoned plugins are a frequent culprit.

Hours twelve to twenty-four: clean properly

Replace core, plugins and themes from fresh, trusted sources rather than trying to disinfect infected files in place.
Remove backdoors — often small PHP files in upload folders or disguised with plausible names.
Search the database for injected scripts and spam content.
Remove or update whatever let them in. If it’s an abandoned plugin, replace it.

Then: recover your reputation

Once it’s genuinely clean, request a review in Google Search Console, request removal from any other blocklists, and clean up spam pages that were indexed under your domain.

Afterwards

Most compromises we see trace back to maintenance that stopped happening. Updates applied on a schedule, unused plugins removed, strong unique passwords with multi-factor authentication, and backups stored where the web server can’t reach them prevent the large majority of repeats.

For the full picture, see Google is warning visitors that our site is dangerous. Cleanup and maintenance sit in our WordPress practice.

WordPress
Incident Response
Malware