Most WordPress compromises aren't discovered during the hack – they're discovered weeks later, from a browser warning or a client email. Here's what happens in between.
Key takeaways
- Most WordPress hacks are discovered indirectly – a Google Safe Browsing warning, a hosting suspension notice, or a client asking about strange redirects – not caught in the act.
- Cleanup means finding and removing every backdoor, not just the visible symptom; miss one and the same site gets reinfected within days.
- The technical fix is often the fast part – blacklist removal, rebuilding trust and SEO recovery are what actually stretch recovery out.
A hacked WordPress site rarely looks like the movies. There's no dramatic defacement in most cases – just something quietly wrong that someone else usually notices first: a browser warning, a hosting provider suspension email, or a client asking why your site redirected them somewhere strange. By the time it's discovered, the compromise is often weeks old.
How it usually starts
The entry point is almost always one of a short list: an outdated plugin with a known, unpatched vulnerability; a brute-forced admin login using a weak or reused password; or, less common but more damaging, a compromised update channel on a plugin that looked completely legitimate. From there, an attacker plants a backdoor – a way back in that survives a normal password reset.
What it actually looks like
Obvious defacement is rare, because it gets noticed and fixed fast – which isn't useful to an attacker. Far more common: spam pages quietly indexed under your domain, targeting pharmaceutical or gambling keywords; malware served only to certain visitors so it stays invisible to you; your server added to a botnet or used to attack other sites; or a search engine blacklist that tanks your traffic overnight with no visible change to the site itself.
The recovery sequence
A proper cleanup isn't “delete the obvious bad file.” It's: take the site offline or isolate it, identify every entry point, scan every file and every database table for injected code (not just the ones an antivirus-style scanner flags), remove every backdoor, rotate every credential – WordPress admin, hosting, database, FTP, API keys – and only then bring the site back and request removal from any blacklist it landed on.
Why it takes longer than people expect
Sites that get reinfected within days of being “cleaned” almost always had a backdoor missed the first time – attackers routinely plant more than one. And getting off Google's Safe Browsing blacklist isn't instant even after the site is genuinely clean; the review adds its own delay on top of the technical fix.
The real cost isn't the cleanup invoice
The technical work is often the fast part. What lingers is the search ranking damage from a blacklist period, the traffic that doesn't come back automatically once you're delisted, and the harder-to-measure trust cost if a client or visitor was the one who told you something was wrong.
We're not in the business of scaring anyone into migrating a site that's working fine. But if your WordPress site holds real business risk, it's worth knowing that a static export or an Astro rebuild removes most of this specific risk outright – there's no wp-admin to brute-force and no plugin update channel to compromise. See the four ways to move off WordPress, or talk to us about your specific site.