Then tell Google
When every affected page is clean, request a review in the Search Console Security issues report and explain what you fixed.
Hacked WordPress site warning
WordPress's own guide sets out the order: document what you see, scan the site, reset all access, back up, remove the hack, update, and change passwords again. Then request a review in Search Console.
Diagnose it
Symptoms, checks and fixes
Common symptoms
- Google, your host or antivirus tools flag the site.
- New admin users, pages or redirects you did not create.
Checks to run
| Check | How to tell | Fix |
|---|---|---|
| What exactly is wrong? | Write down what you see, when you noticed it and any recent plugin, theme or setting changes. | Keep this record; it guides cleanup and any help you bring in.[1] |
| Have all access points been reset? | List every way in: WordPress admin users, hosting panel, FTP or SFTP, and the database. | Reset all of them with long unique passwords, and regenerate the security keys in wp-config to log everyone out.[1] |
| Are core files clean? | Compare files against the same WordPress version, paying attention to .htaccess and theme files such as header.php and functions.php. | Replace wp-admin and wp-includes with clean copies of the same version, then review wp-content.[1] |
| Is everything updated? | Check WordPress, theme and plugin versions. | Update once clean, then change passwords again.[1] |
FAQ
Frequently asked questions
Should I just reinstall from the admin screen?
WordPress's guide advises replacing files by FTP or SFTP instead, because installers may only overwrite existing files while hacks often add new ones.[1]
How long will Google take to remove the warning?
Google says most security reviews take several days or weeks.[2]
How we work together
Two ways to get started
Website Subscription
Your website, fully managed — no big upfront cost.
We design, build, host, maintain and keep improving your site for one simple monthly fee.
- Custom-designed & built for your brand
- Hosting, security & maintenance included
- Ongoing edits & content updates
- Continuous SEO & performance improvements
- Scale up or down as you grow
Fixed Project
A one-off custom build you own outright.
A defined scope and a single fixed quote — delivered once, and yours to keep.
- Bespoke design & development
- Defined scope & timeline
- You own the website & code
- Optional care plan after launch
- Custom-quoted to your needs
Sources
- [1] WordPress Documentation: FAQ My site was hacked. Checked 10 October 2026.
- [2] Search Console Help: Security issues report. Checked 10 October 2026.
Ready to get started?
Get a free, no-obligation quote for your project. We respond within 24 hours.