If your WordPress website is hacked, the job in the first hour is to stop the site harming visitors and to keep a way back to a clean copy. It is not to install a random cleanup plugin and hope the homepage looks normal again. ShubhKarma Tech sees this on brochure sites, WooCommerce catalogues, and older WordPress builds for businesses in Dehradun and elsewhere: a search warning, a redirect, a new admin user, or spam pages that the owner did not publish.
This is an owner’s checklist. It is the order we follow before any redesign conversation. It is not a promise that every compromised site can be cleaned in an afternoon, and it is not a guide to breaking into a site.
Confirm that the site is actually compromised
Not every strange layout is a hack. A bad plugin update and a compromise look similar until you check.
Signs that deserve an immediate response: Google Chrome or Search Console warns visitors, the site redirects to another domain, new pages you did not write are in the index, a user you do not know is an administrator, or the host has mailed you about malware.
Signs that can wait for a normal debug: one plugin’s layout broke after an update, a form stopped sending, or the homepage looks wrong only when you are logged in. Still take a backup before you click further. Do not treat a warning from Google as a theme glitch.
Open Google Search Console if you already have it, and look at Security issues and Manual actions. That is Google telling you what it found. A host abuse ticket means the same thing from the server side.
Contain it before you edit anything
If the public site is redirecting people or showing content you did not publish, take it offline. Maintenance mode is enough when you still control wp-admin and the host. If you do not trust the admin, or the host has already flagged the account, ask the host to suspend public access and keep the files. Say that you need a copy retained, not deleted.
Do this from a computer you trust. If the same laptop has been used with a password manager popup you did not expect, or you downloaded a “security” plugin from a link in a surprise email, use a different device for the recovery logins.
Write down what you saw and when: the URL that redirected, the new user, the hour the host wrote. That note is what you will hand to whoever cleans it. Do not pay a stranger who emails you offering to fix it the same day. Those messages often follow the public warning.
Passwords, users, and access
Change passwords after you are on a clean device, and change them at the source, not only inside WordPress.
WordPress administrator accounts. Hosting panel. Database user. SFTP or FTP, if it is still enabled. The domain registrar. The email account that receives password resets for all of the above. Any plugin that stores its own login, such as a form or backup service.
Then open Users in WordPress and remove administrators you do not recognise. Check the email address, not only the display name. A compromised site often adds an extra admin and leaves yours in place so you do not notice.
Turn off unused editor and author accounts until you know the site is clean. If your team shares one admin login, this is the week that practice ends.
Restore a clean backup, or stop and get help
A backup from before the compromise, stored somewhere other than the same WordPress server, is the cleanest recovery. Restore it, then update WordPress, the theme, and every plugin before you put the site public again. A restore that goes live still running the old vulnerable plugin is how the same problem returns on Thursday.
Check the backup date against the first day you noticed trouble. Restoring last night’s backup does nothing if last night’s backup was already compromised. When you are unsure, keep that backup aside and ask someone to compare it with an older one.
If you have no backup, do not start deleting files because a forum list told you to. A live hacked site is a bad place to learn which file is yours. Take the host’s copy, put the public site in maintenance, and hand the copy to someone who does this work. At ShubhKarma Tech we would rather restore a known site than promise a file-by-file cleanup we have not seen.
Nulled themes and plugins — paid products downloaded free from an unknown site — are a common reason the backup itself cannot be trusted. If that is how the site was built, plan on a clean theme and a fresh install of the plugins you actually use, not a restore of the pirated copy.
After the site is back
Update WordPress core, themes, and plugins. Delete themes and plugins you do not use. An inactive plugin can still be the way in.
Replace WordPress security keys. WordPress.org documents this as regenerating the salts in `wp-config.php`. It signs people out everywhere, which is what you want after a compromise. Your host or a developer can do it in a minute. You do not need a custom plugin for it.
Confirm the public site serves your pages and nothing else. Click the homepage, a sample of inner pages, and the checkout if you sell. Watch for a redirect that only happens on a phone, or only when you are logged out.
In Search Console, request a review once the security issue is actually gone. Asking early, while the redirect is still there, just resets the wait.
If the site takes payments or stores customer details, tell your host and look at the payment plugin’s own notices. If customer data may have been exposed, get advice on who you need to inform. This article is not that legal advice. Do not assume a cleaned homepage means the order database was untouched.
Lock the things that made it easy
The durable fixes are dull.
Updates applied on a schedule, not when the site is already warning visitors.
Two-factor authentication on WordPress and on the host.
A limit on login attempts, so a password is not guessed overnight.
Backups that leave the server: a copy you can download, on a date you can point to.
SFTP rather than FTP, and no shared “admin” password in a WhatsApp group.
A real theme and real plugins. If a feature came from a zip file with no author, remove it.
An administrator count you can say out loud.
For a business site in Dehradun — a hotel, a catalogue, a local service — also check that the Google Business Profile phone number and the site phone number were not changed. We have seen the website defacement get fixed while the map listing still pointed at someone else’s number.
When to call a studio instead of another plugin
Call for help when you cannot log in, the host has suspended the account, the site still redirects after a restore, or you find users and plugins you did not install and you do not have a backup from a clean week. A cleanup plugin that asks you to pay inside wp-admin on an already hacked site is not the help.
ShubhKarma Tech will look at what you have: host access, the last backup date, and whether the theme was licensed. If the site is an old page-builder stack that keeps breaking, the honest recommendation is sometimes a rebuild on a maintained theme, or a move off WordPress, not a third rescue of the same files. The migration guide on this blog is for that decision, after the site is contained — not as a panic rewrite on the day you discover the redirect.
If you are staring at a warning page today, start with contain, passwords, and the newest backup you trust. Send us the host, the day it started, and whether customers can place orders. We will tell you whether this is a restore or a rebuild.