My WordPress site was hacked: what to do now
Document the symptoms, contact your host, protect access and preserve a clean recovery point before making changes. A visible malware warning needs a careful cleanup, not a rushed plugin install or password change alone.
Updated 20 Oct 2026