Your WordPress site is hacked. Do not wipe it yet.

What this usually is

“Hacked WordPress” is usually one of a few things: PHP dropped into a theme or mu-plugins folder, a rogue administrator, spam posts that only Googlebot sees, JavaScript that redirects phones, or a wp-config.php that loads a file you never put there. The homepage can look fine while the rest of the site is a spam farm.

What you are probably seeing

• Google titles mention casinos, loans, pills, or crypto on URLs that look normal when you visit
• Links in the footer, sidebar, or posts that nobody on staff added
• The site redirects on phones, or only when you are not logged in
• A WordPress user you did not create, often with an Administrator role
• Host or Google Safe Browsing flagged malware or “this site may be hacked”
• A previous one-click host cleanup that lasted two days

What not to do

• Do not restore last night’s backup until someone checks whether the backup is already dirty. Most people restore the injector.
• Do not install three security plugins on a still-compromised site. You are locking the door with the burglar inside.
• Do not click “update all plugins” as the cleanup. A nulled or abandoned plugin is often how they got in.
• Do not hire the Skype or Telegram “Google ranking team” that emailed you after the spam titles appeared. That is the same industry.
• Do not take the whole store offline because one inner page is spam. We take a backup first and work so checkout keeps taking orders unless the cart itself is the compromise.

What we actually do

Phase A is emergency cleanup: full file and database backup, find what was planted, remove it, restore hijacked pages, written report you can show a board, insurer, or Google. Phase B is hardening so the same door does not reopen next week. Combined A + B starts at $4,200. Existing clients and nonprofits can ask about a courtesy. Hosting can stay yours.

Published rates live on the WordPress incident-response packages page: Phase A from $2,500, Phase B from $2,000, combined from $4,200. Remote nationwide. Onsite in the Tri-Cities and Western North Carolina if you want someone in the room. If the WordPress site is the front door to a larger business compromise, start at emergency incident response instead.