Or the login just stops working. And now…it’s a situation.
We’ve been pulled into a lot of these “weird” situations. Sometimes it’s obvious, malware everywhere, files changed, admin users added that nobody recognizes. Other times it’s quieter – a single injected script or something that has been sitting there for weeks.
The difference between those two usually comes down to how long it went unnoticed.
What “Fixing a Hacked WordPress Site” Actually Looks Like
There’s this idea that you run a scan, click “clean,” and you’re done, but that…is a fiction.
Sometimes the infection is in the database. Sometimes it’s in a theme file that hasn’t been touched in years. Sometimes it’s a plugin that looked harmless but had a known issue sitting there. Sometimes, it lives in the server’s memory and cannot be deleted like a file can be deleted.
We’ll usually start by isolating the site. Not always taking it offline, depends on the situation, but at least stopping the spread. Then digging through files, comparing against known clean versions, using a wide array of scanners and other malware identification tools to find that which does not belong.
Often there is more than one entry point. Hackers like to give themselves a “back door” as soon as they get access.
We’ve seen sites cleaned three times before they came to us that are still infected in some subtle way. Sometimes it is a leftover cron job or a backdoor tucked into an uploads folder, and sometimes it is more insidious.
And Then There’s the Part People Miss
Cleaning it is one thing. Figuring out how it got in (the “vulnerability”) – that’s the part that actually matters.
Otherwise the malware infection just comes back (usually after a pause long enough to make you think that you were rid of it).
Outdated plugins, a single weak admin password, file permissions, soft hosting config, something. There’s always a reason. We trace that down and then test the heck out of it.
Security Isn’t a Plugin
Plugins are useful. We use them. But they’re tools, not a plan, and they can’t anticipate some things.
A plugin can flag known malware signatures. It can block some login attempts. But it’s not going to notice that a custom theme file was modified in a subtle way. Or that a user account shouldn’t exist.
That’s where a human has to look at it.
And yeah, that sounds obvious. But a lot of sites we see are basically running on autopilot. Updates turned off because something broke once. Backups that haven’t been tested. Security plugin installed and then… trusted.
How Sites Actually Get Compromised
It’s usually not targeted. That’s the thing.
This is one reason that even “important” sites get taken down by ordinary neglect. A famous example was the Panama Papers breach. Not because someone cracked some impossible code wall, but because one outdated plugin (for a home page slider) was sitting there, exposed. We wrote a little more about that here: WordPress maintenance and the Panama Papers.
Bots just scan the web all day looking for known vulnerabilities. Old plugin versions, exposed endpoints, predictable login URLs. If something responds the wrong way, they try it.
This is why even small sites get hit. It’s not personal. It’s just “business” for the bad actors behind the attack.
If you’re curious how that works at a broader level, WordPress has a solid overview here. It’s worth skimming.
What Ongoing Protection Looks Like (In Reality)
After cleanup, the goal is pretty simple. Don’t end up back here.
That usually means:
- Keeping plugins and themes updated, carefully, not blindly
- Monitoring for file changes that shouldn’t happen
- Locking down access points, login attempts, admin roles
- Having backups that actually restore (this one gets overlooked a lot)
We handle all of that and more through our WordPress maintenance services. The bigger point is just that it needs to be handled somewhere. By someone…because the alternative is waiting until something breaks again.
If Something Feels Off, It Probably Is
That’s usually how these start. A small thing. A report from a customer. A weird page indexed in search results. The site is suddenly a lot slower than it was yesterday and nobody seems to be able to figure out why. A few customers have reported that their credit cards were used for fraudulent purchases after visiting your site.
You don’t need to diagnose it before reaching out. In fact, it’s usually better not to guess. We can take a look, figure out what’s actually going on, and go from there.
Sometimes it’s nothing. Sometimes it’s already in progress.
Let’s Take a Look
If your site is acting strange, or you just want a second set of eyes on it, get in touch. We’ll walk through what we’re seeing and what it would take to get it stable again.
