My WordPress Website Got Hacked: What to Do and How to Prevent It

Take a breath, and get ready to forgive, forget, and move on. That is genuinely the right mindset when your website gets hacked.

WordPress hacks are extremely common, and if it is your first time it can be a scary thing to wake up to. It helps to understand what actually happened.

Why me? Why my website?

First, ninety-nine percent of the time this is not personal. In most cases there is not even a human on the other end. It is software, scanning the web for known vulnerabilities and hitting anything that matches. We could speculate all day about why anyone would target your perfectly innocent site, but the answer is usually boring: they want to use it to spread spam links.

What do I do now?

The good news is your hack was almost certainly lumped in with a batch of similar sites running a similar setup. The usual damage is junk code injected into one or more of your files. It is annoying and it can make your site behave in strange ways, but it is a common problem that is usually quick to resolve. If you do not live in website code, do not try to surgically remove it yourself. Reach out to your hosting provider or a website maintenance service to clean it up and put protection in place.

How do I prevent it next time?

One of the best defenses against the common WordPress attacks is a plugin called Wordfence. It comes in free and paid versions, and for most sites the free version is plenty. A few more steps that take the target off your back:

• Keep WordPress itself on the latest version.
• Keep your plugins stable and updated.
• Make sure ModSecurity is enabled on your hosting server, if it is available.
• Make sure your .htaccess file has correct read/write permissions (ask your host).
• Make sure your wp-content directory has correct, secure permissions (ask your host).

None of this is a guarantee. But between a security plugin like Wordfence and those five points, it becomes far less likely that your site is the one that gets hit.

Developer's advice

The second you are cleaned up, change every password tied to the site (WordPress, hosting, FTP, database) and log out all sessions, not just the account you think was hit. Reinfection almost always rides back in on a credential the attacker still has.