What to do when your WordPress site has been hacked, in order.
Contain it, keep the evidence, change every password, clean it, close the way in, then ask Google to lift its warning. The ACSC's hotline answers day and night on 1300 292 371. What to do in what order, who to tell, what a clean-up costs, and why a cleaned site can be hacked again.
- Call first
- your host
- ACSC, 24/7
- 1300 292 371
- Small business help
- IDCARE, free
- Customer data taken
- 30 days to assess
- Google review
- days to weeks
- Clean-up from
- US$98 a site
- Price
- see our own price list
Phone numbers and rules as at 24 October 2026. Prices in US dollars.
Australia · 2026Contain it, keep the evidence, clean it, and close the way in.
If your WordPress site has been hacked, call your host first. Ask them to take the site offline or show a maintenance page, and to keep a copy of the files, the database and the server logs before anyone cleans anything. The logs show how the attacker got in, and a site cleaned without knowing that can be broken into the same way next week.
Then change every password the site touches, from the WordPress admins to the hosting, database, email and domain, and turn on two-factor sign-in. Restore a backup from before the break-in or pay a clean-up service, update or delete whatever let them in, and ask Google to review the site once every page is clean.
You don't have to do it alone. The ACSC's hotline, 1300 292 371, answers day and night, and IDCARE gives small businesses free help on 1800 595 170. If customer details may have been taken and the Privacy Act covers your business, you have 30 days to work out whether it's a breach you must report.
Expect them to try again. GoDaddy's researchers found backdoors in nearly every spam infection in 2025, and server logs showing attackers logging in with stolen passwords, uploading a fake plugin and switching it on, all within 30 seconds. A clean-up that leaves the same plugins, PHP and login page behind is a pause, not a fix.
Five signs your WordPress site has been hacked.
- 01
Google says so.
A line reading This site may be hacked under your result, a red warning page in Chrome, or an email about Search Console's Security Issues report.
- 02
Google shows pages you never made.
Search for site:yourdomain.com.au and look for gambling, pills, knock-offs or pages in another language.
- 03
Visitors end up somewhere else.
Customers mention scam pages or pop-ups, often only on phones or when they arrive from Google, which you won't see while logged in.
- 04
Users, plugins or files nobody added.
An administrator you don't recognise, a plugin nobody installed, or settings that changed overnight.
- 05
Your host steps in.
A malware warning, a suspended account, or a note that your site is sending spam.
Some hacks show the owner nothing at all. A card skimmer on the checkout looks exactly like the normal page.
What to do, in order, from the moment you notice.
- 01
Call your host.
Ask them to take the site offline or show a maintenance page, and to copy the files, database and server logs before any cleaning. Ask what their hacked-site help covers, and what it costs.
- 02
Keep a record.
Screenshots, the time you noticed, and any emails from Google or your host. With the host's copy, it's what the ACSC, your insurer and, if it comes to that, the OAIC will ask for.
- 03
Change every password, then turn on two-factor.
WordPress admins, hosting, database, SFTP, email and the domain registrar. Delete admin users nobody recognises, and sign everyone out.
- 04
Restore a clean backup, or have it cleaned.
A backup from before the break-in is quickest, if you know when that was. Otherwise a clean-up service removes the infected files and database entries, from US$98 for one site.
- 05
Close the way in.
Update WordPress, the theme and every plugin, delete the ones you don't use, and ask your host which PHP version the site runs. Restoring a backup brings back the same hole, so this step isn't optional.
- 06
Ask Google to lift the warning.
In Search Console's Security Issues report, request a review once every page is clean. Google says reviews take a few days to a few weeks.
- 07
Tell the people who need to know.
Report it to the ACSC through ReportCyber. Call your bank or payment provider if payments were involved, and warn customers whose details may have been exposed.
- 08
Decide whether WordPress stays.
If it's the second time, or nobody can say how they got in, a clean-up buys time rather than safety. A static rebuild has no PHP, database or public login page left to break into.
Paid a ransom? A business turning over $3 million or more must report the payment to the ASD within 72 hours.
What attackers do with a hacked WordPress site.
| Compared on | What they do | What it costs you |
|---|---|---|
| Spam pages | What they do Add pages selling gambling, pills or knock-offs, often shown only to Google. About a third of what GoDaddy found in 2025 | What it costs you Your result can be marked as possibly hacked, and your real pages lose their place |
| Redirects | What they do Send visitors from Google, or on phones, to scam sites while you see the normal site. About a fifth of what GoDaddy found | What it costs you Customers lose trust, and Chrome can put a red warning in front of your site |
| Fake prompts | What they do Show a fake browser update or a prove-you're-human box that installs malware | What it costs you Your visitors' computers get infected, which is what Google warns people about |
| Card skimmers | What they do Copy card details from the checkout as they're typed. Nothing looks different | What it costs you A data breach. Your payment provider and your customers need to know |
| New admin users | What they do Create an administrator account, so they can log in the way you do | What it costs you They can change anything, and come back after a clean-up |
| Backdoors | What they do Hide a file that lets them back in. GoDaddy found these on 29,195 sites in 2025 | What it costs you The usual reason a cleaned site is hacked again |
| Ransomware | What they do Lock the files, or replace the site with a demand for payment | What it costs you A restore from a backup kept off the server. Karis Life's WordPress store was hit twice before it moved |
What you can see is rarely all they did. Google won't lift its warning for a site that's only partly clean, so clean every page, then the database, then the way in.
What fixing it costs, and what it leaves in place.
From your host's help to leaving WordPress. Prices checked on 24 October 2026: the security services in US dollars, our rebuild in Australian dollars before GST.
| Cost | Option | What it covers |
|---|---|---|
| Cost $0 Your host's help | Option Many hosts restore a backup or scan for malware as part of the plan. Ask before paying anyone else. | What it covers Yesterday's copy, back up. The hole that let them in comes back with it. |
| Cost US$98 once A one-time clean-up | Option Sucuri cleans one site for US$98, with a first reply in about 30 hours and a report of what it found. | What it covers This infection. A second one isn't covered. |
| Cost US$229–549 a year A security plan with clean-ups | Option Sucuri's plans include unlimited clean-ups and a firewall, with faster replies on the dearer plans. | What it covers Clean-ups whenever needed, for as long as the site stays on WordPress. |
| Cost US$590–1,250 a year Incident response cover | Option Wordfence Care, or Wordfence Response with a one-hour reply around the clock and a fix within 24 hours. | What it covers A store or a busy site that can't be down for a day. |
| Cost $9,000–18,000 once Leaving WordPress Ours | Option A static rebuild with every page moved and every old address redirected, and no PHP, database or public login page left on the site. | What it covers The second break-in, or the first one nobody can explain. |
Who cleans hacked WordPress sites, and what to ask them.
- 01
Will you find out how they got in?
A report that names the way in, so it can be closed. Without it, the same attack works again.
- 02
Do you clean the database as well as the files?
Spam and redirects often sit in the database, and backdoors in files made to look like WordPress's own.
- 03
What happens if it comes back?
One-time clean-ups usually exclude a second infection. Get the answer in writing either way.
- 04
Who asks Google to lift the warning?
And what the request will say, since asking before the site is clean slows the next review.
- 05
Who looks after it afterwards?
A name and a response time for the next alert, or the clean-up is temporary.
- 06
We move you off it.
Croissant & Baguette is a small studio with a network of Australian specialists. Built in Australia, never offshored. We don't clean up WordPress sites. Once yours is clean, we rebuild it as a static site or a Shopify store, with every old address redirected and nothing of WordPress left to break into.
Karis Life made that move after ransomware hit its WordPress and WooCommerce store twice.
What we charge.
- Website build static, pre-rendered, designed from scratch
- from $9,000 typically $9–18k
- Shopify store a WooCommerce store moved to a custom Shopify theme
- from $9,000 typically $9–16k
- Content migration your pages, posts and products, off WordPress
- quoted typically $1–4k
- Care plan monitoring, updates, small changes and a monthly speed report
- from $250/month
What moves the price within those ranges:
- how many pages, posts and products move across
- how many old addresses need redirecting
- which plugins get replaced, and by what
- connections to bookings, payments or other software
Why we rebuild instead of cleaning
Because a clean-up removes what the attacker left, not what let them in. The plugins, the PHP and the login page are all still there the next morning. A static rebuild takes those parts away, so there is nothing of that kind to clean up next time.
Fixed quote after a 20-minute call. Bug fixes and critical updates are included for the first 12 months.
What should I do first if my WordPress site is hacked?
Call your host and ask them to take the site offline and keep a copy of the files, database and logs before anything is cleaned. Then change every password the site touches and turn on two-factor sign-in. Cleaning comes after that, and so does finding out how they got in, which is the part that stops it happening again.
How do I know if my WordPress site has been hacked?
Google often says so first, with a This site may be hacked line under your result or a red warning in Chrome. Other signs are pages in Google you never wrote, visitors sent to scam sites, admin users or plugins nobody added, and your host suspending the site. Some hacks show nothing to the owner and only target visitors.
How much does it cost to fix a hacked WordPress site?
From nothing, if your host restores a clean backup, to US$98 for a one-time clean-up of one site from Sucuri, or US$229 to US$1,250 a year for a security plan with clean-ups and faster replies. None of those removes the reason it was hacked, and a one-time clean-up does not cover the site being hacked again.
Do I have to report a hacked website in Australia?
Report it to the ACSC through ReportCyber, or call 1300 292 371. If personal information may have been taken and the Privacy Act covers your business, assess it within 30 days, and tell the OAIC and the people affected if serious harm is likely. A business turning over $3 million or more that pays a ransom must report the payment within 72 hours.
How long does it take Google to remove the hacked warning?
A few days to a few weeks after you request a review in Search Console's Security Issues report, by Google's own estimate. Fixing only some pages doesn't count, and asking before the site is clean slows things down: a site that keeps flipping between clean and infected is marked a repeat offender and can't ask again for 30 days.
Why does my WordPress site keep getting hacked?
Usually because the way in is still open, or the attacker left a way back. Nearly all the spam infections GoDaddy found in 2025 came with a backdoor, and many attacks simply logged in with stolen passwords. Patchstack found that 46% of new WordPress flaws were still unpatched on the day they were announced, so even an up-to-date site can be exposed.
Should I rebuild my site instead of cleaning it?
Clean it first either way: customers and Google need the infection gone today. Rebuild if it's the second time, if nobody can say how they got in, or if keeping WordPress safe needs more attention than anyone has. Karis Life moved its store to Shopify, built by us, after ransomware hit its WordPress and WooCommerce site twice.
Sources
Read on 24 October 2026; the government pages carry the latest numbers and rules.
- 01 Recover from hacking ASD's ACSC · what to do first
- 02 Report a cyber security incident ASD's ACSC · hotline 1300 292 371, 24/7
- 03 When to report a data breach OAIC · Notifiable Data Breaches scheme
- 04 Quick reference guide for responding to data breaches OAIC · 30 calendar days to assess
- 05 Small business OAIC · who the Privacy Act covers
- 06 Ransomware payment reporting Home Affairs · factsheet, from 30 May 2025
- 07 IDCARE IDCARE · free small business help, 1800 595 170
- 08 Security issues report Search Console Help · review times
- 09 Safe Browsing repeat offenders Google Search Central · 30 days
- 10 This site may be hacked Google Search Help · the label and how it goes
- 11 GoDaddy annual cybersecurity report GoDaddy · 16 June 2026, 2025 figures
- 12 State of WordPress Security in 2026 Patchstack · 2025 figures
- 13 One-time cleanup Sucuri · US$98 for one site
- 14 Website security platform plans Sucuri · US$229 to US$549 a year
- 15 Wordfence pricing Wordfence · Care and Response
- Leaving WordPress. Every page moved across, every old address redirected, and nothing left to patch.
- PHP2Shell. The October 2026 PHP flaws, what to check, and what to ask your host.
- Keep your rankings. How to move off WordPress without losing your place on Google.
- WordPress or pre-rendered? Speed, running cost and security side by side, and why we left WordPress.