In short: If your WordPress site shows foreign content, redirects or is suddenly slow, assume the worst and get in touch now. We take over from the first message: preserve evidence, block access, look for backdoors, clean up the site and document the incident. All remotely, with no travel.
Do not delete anything and do not rebuild anything right now. Anyone who removes plugins or restores a backup before the evidence is secured destroys the traces of the break-in. Affected? Call us or write to us on WhatsApp, or go straight to Report an emergency.
Is Your WordPress Hacked?
An attack on WordPress is not always noticed. These signs point to a compromise:
- Visitors are redirected to foreign sites, ads or fake shops, often only from mobile devices or from search engines
- pages appear in Google in your name with pharma, gambling or foreign-language text, see SEO spam in the Google index
- the dashboard shows administrators that nobody created, or passwords suddenly cannot be reset
- the folder
wp-content/uploadscontains.phpfiles that do not belong there (how to interpret such finds) - plugins or themes appear that you never installed, or disappear again on their own
- your host reports spam sending or high load, or blocks the site
- the browser or Google shows a warning about your site
More signs at server level are listed under Am I already compromised?.
What to Do Right Now
- Put the site into maintenance mode or take it offline if visitors are at risk. Leave the files unchanged while doing so.
- Uninstall nothing and delete no files. Not even plugins that look suspicious.
- Have the logs secured: Ask your host not to overwrite access and error logs. Trade press advises keeping server logs from 20 October 2026 onward.
- Collect access details: Who has WordPress admin, FTP, SSH, hosting panel and database access? Note that down, but change passwords only after consultation and from a clean device.
- Check the mailboxes: The account registered as the admin address in WordPress can be used to reset passwords.
- Inform those involved: Management, the data protection officer and, where applicable, the insurer.
- Get in touch with us before you intervene further yourself.
How Does PHP SOS Help With a Hacked WordPress Site?
- Assess the situation: We clarify what you see, which plugins and themes are running, who had access and where the server is.
- Secure and close: Files, database and logs are secured, suspicious access is blocked, and the site is isolated if necessary.
- Check and clean up: We compare the core files with the original (this post explains how), look for backdoors in plugins, themes, uploads and the database, and remove them. The approach corresponds to our service Removing malware and webshells.
- Harden and report: PHP version, permissions, admin protection and updates are checked. You receive a report with a timeline, findings and recommendations.
WordPress Update Against PHP2Shell: Why It Is Not Enough
Many operators believe that with the latest WordPress version everything is done. That is not true. PHP2Shell, that is CVE-2026-109618 and CVE-2026-109619, sits in the PHP interpreter on which WordPress runs. It is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to Dr. Web, WordPress.org plans no update of its own for it. What matters is the PHP runtime on your server; more on this in Why a WordPress update does not help and on the page WordPress and PHP2Shell.
Equally true: a PHP patch does not remove malicious code that has already been planted. Both must be checked together.
Backdoors in WordPress: Where They Hide
Attackers like to place access where people rarely look: in mu-plugins, in theme files such as functions.php, in image folders with a double file extension, in the table wp_options or in scheduled WordPress tasks. Details and ways to check are under Finding backdoors in WordPress. After the cleanup, every admin login should be secured with two-factor authentication.
If your site is flagged as dangerous by Google or a browser, we first eliminate the cause and then support the review. The procedure is described in Removing a Google warning.
How We Release the Site Again
A WordPress site goes back online only when core files, plugins and theme have been checked, credentials and keys in the configuration have been renewed, and no suspicious user exists any more. Then we check the public site from a visitor's point of view, also from a phone, because some redirects occur only there. Afterward we recommend closer monitoring for the following weeks. There is no promise that the site will never be attacked again, but there is a documented, verified state.
What You Should Send Us
- the address of the site and, if known, the host
- since when and how you noticed something
- screenshots of warnings, redirects or foreign admin accounts
- a list of the plugins and the theme, as far as known
- the state of the last backup
Please do not send access credentials by email unprompted; we agree the secure way with you.
Why PHP SOS
We work Made in Germany and, together with our partner network of cyber professionals, have specialized in IT security for over 25 years. You have one contact who accompanies your case from the first message to the close. We work remotely across Germany and Europe, document every step and promise only what can be kept: we work until the incident is closed and documented. If personal data may be affected, the report also helps you with the GDPR notification; the legal assessment remains with your data protection officer. The full service is described on the page Website hacked: emergency help.
Affected? Call Us. We Help.
If your WordPress site is behaving suspiciously, do not wait for the next irregularity. Get in touch now, by phone or WhatsApp, and we take over from the first message. Report an emergency now
Frequently asked questions
Is it enough to update WordPress and all plugins if the site was hacked?
No. An update closes vulnerabilities for the future but does not remove a backdoor that is already on the server. In addition: the PHP vulnerability PHP2Shell sits in the PHP interpreter, not in WordPress. According to reports, WordPress.org plans no update of its own for it.
Can I restore an old backup and be done?
Only with caution. If you do not know when the break-in happened, you may be restoring files that are already infected. Also, the entry point stays open if nobody has found it. First secure, then assess, then restore.
How do I recognize a hidden admin account in WordPress?
Some accounts are not shown in the user list because malicious code filters the output. A comparison directly in the database and a check against the people you know shows more. This is part of the cleanup, which we take over.
Why does the malicious code keep reappearing after I delete it?
Usually there is a second backdoor or a mechanism that reloads files, such as a scheduled task or manipulated files in unusual folders. Anyone who deletes only visible symptoms fights the sign and not the cause.
What does it cost if Google flags my WordPress site as dangerous?
That depends on scope and effort and can be said only after an initial assessment. It makes sense to eliminate the cause first and then request the review from Google.