It is unpleasant, and it is fixable. Work through this in order, and do not skip the last section, because a site cleaned without closing the hole is a site that gets hacked again next week.
Signs of a compromise
- Content on your site you did not put there, often pharmaceutical or gambling spam
- Visitors redirected to another site, sometimes only from search results or only on mobile
- A browser or search engine warning about your site
- Admin users you do not recognise
- The site suddenly very slow, because it is being used to send spam
- Your email suddenly bouncing everywhere, for the same reason
Do this first
- Email [email protected] immediately. If your site is down or serving malicious content, we treat that as urgent and answer as fast as humanly possible, at any hour.
- Change every password. Your control panel password, every WordPress admin password, your database password, your mailbox passwords. Assume all of them are known to the attacker.
- Remove any admin user you do not recognise.
- Do not simply restore and walk away. A restore removes the visible damage, but if the hole is still there, you will be back here within days.
Cleaning it
Restore from a backup taken before the compromise. Look at your backups and pick a date you are confident was clean. On Starter you have 7 days, on Pro 14, on Premium and Platinum 30. This is precisely why longer backup history matters, because a compromise is often discovered long after it happened.
Then close the hole. Update WordPress core, every plugin and the theme, all to current versions. Delete every plugin and theme you are not actively using. If the attacker got in through a specific plugin, remove that plugin entirely rather than updating it.
Preventing the next one
Read Keeping WordPress secure and do the six things in it. In particular: update regularly using staging so you have no excuse not to, delete unused plugins and themes, never install cracked premium plugins, and remove old admin accounts.
We are on your side here
Tell us what happened. We would much rather help you clean it up properly than have you patch over it and be back in a fortnight.
The assistant in your control panel can see your actual account and answer about your sites, your plan and your usage. For anything else, email [email protected] and a person will answer.