Outdated plugins, themes and WordPress
Every security update makes an old hole public. Bots then try exactly that hole on thousands of sites a day. A plugin that hasn’t been updated for months is an invitation.
Problem: security
Your website has been hacked. You weren’t the target. You were an open door.
A hacked website doesn’t mean someone picked you out. Automated bots scan the web around the clock for outdated plugins and weak passwords. The good news: if you act calmly in the first 24 hours, the site can usually be saved.
Signs your website has been hacked
- Google shows “This site may be hacked” under your search result.
- Chrome shows a red full-screen warning before your site opens.
- Visitors coming from Google or on a phone end up on a casino or pharmacy site, yet when you type your address, everything looks normal.
- A search for site:yourdomain.com shows pages you never created, sometimes in Japanese.
- Admin users you don’t recognise appear, or your host has suspended your account.
How attackers get in
Weak or reused passwords
“admin” and “company2020” are guessed in minutes. A password you also used on another site that was breached ends up on public lists. Without two-factor authentication, one password is all that stands between an attacker and your site.
Pirated or abandoned themes and plugins
“Free” copies of paid themes often come with a backdoor already built in. Plugins their authors no longer maintain get no fixes, however often you click update.
No backups, no monitoring
They don’t cause the attack, but they make it much worse. Without monitoring you find out weeks later, from a customer. Without a clean backup, there is no version to go back to.
The first 24 hours, step by step
1. Don’t panic, and don’t delete everything
Deleting the site doesn’t remove the Google warning, but it destroys your content and the traces of the attack. Take screenshots of what you see and note the time and how you found out. You will need them later.
2. Back up the current state
Save the files and database exactly as they are now, infected or not. If something goes wrong during the cleanup, you lose nothing. Then ask your host which backups they have and from which days, so you can find one from before the attack.
3. Change every password, from a clean device
Hosting control panel, FTP or SFTP, database, every admin on the site and the email accounts on your domain. Delete users you don’t recognise and turn on two-factor authentication. Scan your own computer with antivirus too: stolen FTP passwords often come from an infected PC.
4. Clean the site
The simplest route: restore a clean backup from before the attack, then immediately update WordPress, the theme and every plugin. Without a clean backup, reinstall them from official sources, delete unknown plugins, look for unfamiliar PHP files in the uploads folder and changes to .htaccess and wp-config.php, then scan with a security plugin. Restoring alone isn’t enough: if the hole stays open, the attack comes back.
5. Request a review in Google Search Console
In Search Console, under Security & Manual Actions, the Security issues report shows what Google found, with example pages. Once the site is clean, confirm you have fixed the issues and click “Request review”, with a short description of what you did. The review can take a few days, sometimes several weeks.
6. Close the door for next time
Turn on automatic updates where you can, daily backups stored off the server and two-factor authentication for everyone. Spam pages created by the attackers must be removed from the site itself, not just from the menu; then resubmit your sitemap.
When it’s worth calling a pro
If you can’t find how they got in, if the site gets reinfected after cleaning, or if you run an online shop with customer data, stop trying alone. I look at the site and tell you honestly whether it is worth cleaning, or whether a new site is the safer and cheaper route, from €499. My sites are coded from scratch, without other companies’ plugins, so there are far fewer doors to force. And monthly care, €69 or €99, includes daily backups, round-the-clock monitoring and security scans, so you find out in minutes, not weeks.
Frequently asked questions
Why me? My business is no big corporation.
That’s exactly why. Attacks are almost always automated: bots don’t look for big companies, they look for vulnerable sites. Your server is then used for spam, redirects or fake pages.
Will the Google warning go away on its own?
No. It stays until you clean the site and request a review in Search Console. Only once Google confirms the site is clean does the warning disappear.
What if customer data was exposed?
If attackers could have accessed personal data and you operate in the EU, the GDPR may require you to notify the data protection authority within 72 hours of becoming aware of it. This is general information, not legal advice; talk to a specialist.
Does a security plugin help?
Yes, as an extra safety net, not a replacement. Updates, strong passwords, two-factor authentication and backups matter more than any plugin.
Other common problems
See all problems →Take a 2-minute quiz →
Written by Raul Gabriel Nagy
Founder of RAGANA Studio, web designer since 2009. I hand-build websites and online shops for businesses in Romania, Hungary, Austria and Germany, and run my own online shop, raganadesign.shop. My story →
Updated:Want to fix it together?
Message me on WhatsApp or send a note. I reply the same working day, with a fixed price if you need me.