# Hacked WordPress site: what I do in the first hours > When an agency client's WordPress site arrives hacked, or an infection appears on a site I already maintain, I start right away. I put the site in maintenance mode so visitors do not see the infection or get sent to strange pages. Then I run an immediate diagnosis: whether WordPress core was compromised, whether extra files were injected, or whether a plugin is causing the problem. If the site is already on a care plan, the cleanup is included. Without a plan, hack cleanup is $149 per urgent issue. Canonical: https://fer.marketing/hacked-wordpress Author: Fernando Marcano, Fer Marketing Updated: 2026-11-12 - **First move:** Maintenance mode, so visitors do not see the infection - **Diagnosis:** Core, injected files, or a plugin - **Above WordPress:** Server backdoors and hidden cron jobs - **Price:** Included in the care plan; $149 per urgent issue without one ## Request a hacked WordPress cleanup Send the site URL, what visitors are seeing, and whether the site is already on a care plan with me. Fer LLC, a Wyoming, US business. Phone: +1 310 734 8943. [Request a hacked WordPress cleanup](https://fer.marketing/contact#form) ## What I do in the first hours on a hacked WordPress site The steps are similar on every hacked site, and the solution is always tailored to that page, so a future attack is harder. In emergencies I act in less than an hour, as long as it is within 9 AM to 9 PM ET. An infection or malware counts as an emergency. 1. **Put the site in maintenance mode.** The first thing I do is pause the visits the site is receiving, so people do not see the infection or get sent to strange pages. See [WordPress maintenance mode](https://fer.marketing/wordpress-maintenance-mode) for how that pause works. 2. **Diagnose the cause immediately.** I scan the site right away to see whether WordPress core was compromised, whether extra files were injected, or whether a plugin is causing the infection or bringing in the problems. 3. **Check core file hashes and run an anti-malware scan.** I verify the hashes of every WordPress core file, and I run a scan with an anti-malware tool. 4. **Inspect the server, above WordPress.** I go to the server itself and look for backdoors and hidden cron jobs that are causing problems. That is a layer above WordPress. The point is to be sure the infection does not come back, even if it already looks removed at the WordPress level. 5. **Harden permissions and reset credentials.** I do not only reset or restore file permissions. I tighten them, with strict read and write permissions, so a future hack is much harder. I also reset credentials: every WordPress user password, and the server users and passwords. I review which users exist and confirm with the client which ones are real and which ones they do not recognize. 6. **Add protection that fits that site.** In some cases I install a tool such as Wordfence or a WAF, or something that limits login attempts. If the website only serves visitors from one country, or from a specific list of countries, I can block visitors from the other countries that are not relevant. I always look at what else that particular site needs, to prevent further damage. On sites I already maintain, I jump in and start the cleanup first, then I notify the agency. The agency decides whether to tell the end client. You get a report of what happened and why. If I am only auditing and I do not work together yet, I do notify you directly. Details of that notice are also on the [white-label WordPress maintenance](https://fer.marketing/white-label-wordpress-maintenance#malware-notice) page. ## Why I also check the server, not only WordPress Cheap automated maintenance plans, in the $39 to $99 range, usually only cover the WordPress layer. They apply updates automatically. At that price there is not really a human looking at what is going on, and many things slip through. - **Server-level backdoors.** I have found backdoors at the server level, a layer above WordPress. Those cheap plans would not normally detect them, because they are only checking the lower layer, at the CMS. - **Cron jobs outside WordPress.** I have also found cron jobs that are not in WordPress at all, and that run malicious code. That is why the cleanup is not finished when the WordPress files look clean. I also check the server, so the infection does not reappear. The [WordPress security checklist](https://fer.marketing/wordpress-security-checklist) covers the layers I keep in place after a cleanup. [Fix WordPress](https://fer.marketing/fix-wordpress) is the broader repair service when the problem is not only an infection. ## A real estate listings site I rescued more than once I have rescued a real estate listings site with thousands of pages from malware or hacks more than once. I am not naming the site here. I first rescued it from a hack on the old shared host, then moved it to a new cloud server. About a year later there was a second incident: redirects to external sites, so a page would open and then go to another external page; injected files; cron jobs on the server; and an altered WordPress core. The same site also had a serious speed problem, which I fixed at the server level. The full case, including the load times, is in [Work I can show](https://fer.marketing/#listings-case) on the home page. The server-level cache work is on the [WordPress speed optimization](https://fer.marketing/wordpress-speed-optimization#hosting-case) page. ## Is cleanup included in a care plan? When a site arrives already hacked, the cleanup is included in the plan: the $250 basic plan and the $500 full plan for ordinary sites, and the $500 or $1,000 WooCommerce packages for stores. I do not offer the $250 plan for WooCommerce stores, because a store is too critical to the business. Without a plan, cleanup is $149 per urgent issue. > **Month to month, no contracts:** The care plan is a retainer, month to month. Automatic payment is set for the same day of the month the working relationship started. You can cancel at any time, with no problem. There are no contracts. > **Need a hacked WordPress site cleaned up?** Send the site URL and what visitors are seeing. Say whether the site is already on a care plan with me, or whether this is a one-off cleanup. Fer LLC, a Wyoming, US business. Phone: +1 310 734 8943. [Request a hacked WordPress cleanup](https://fer.marketing/contact#form) ## Want the cleanup handled under your agency brand? Send the site URL and what visitors are seeing. If the site is already on a care plan, cleanup is included. If it is not, I confirm the $149 cleanup, or a fixed written quote if the job is more complex, before work starts. Fer LLC, a Wyoming, US business. Phone: +1 310 734 8943. - Maintenance mode so visitors do not see the infection - Diagnosis of core, injected files or a plugin, plus an anti-malware scan - Server-level check for backdoors and hidden cron jobs - Stricter file permissions and reset credentials, confirmed with the client - A report for your agency, with white-label delivery https://fer.marketing/contact#form ## FAQ ### What do you do first when a WordPress site is hacked? I put the site in maintenance mode, so visitors do not see the infection or get sent to strange pages. Then I diagnose immediately whether WordPress core was compromised, whether extra files were injected, or whether a plugin is causing the problem. ### Do you only clean WordPress, or do you also check the server? I also go to the server and look for backdoors and hidden cron jobs, a layer above WordPress, so the infection does not come back even if it already looks removed at the WordPress level. Cheap automated $39 to $99 plans usually only check the WordPress layer, and they would not normally detect those server-level backdoors or cron jobs outside WordPress that run malicious code. ### Is hack cleanup included in the WordPress care plan? Yes. When a site arrives already hacked, the cleanup is included in the $250 basic plan and the $500 full plan, and in the $500 or $1,000 WooCommerce packages. If there is no plan, cleanup is $149 per urgent issue. ### Do you reset passwords and users after a hack? Yes. I reset every WordPress user password, and the server users and passwords. I review which users exist and confirm with the client which ones are real and which ones they do not recognize. I also tighten file permissions, with strict read and write permissions, not only reset them. ### Do you install Wordfence or a firewall after cleanup? In some cases, yes: Wordfence, a WAF, or something that limits login attempts. If the site only serves visitors from one country or a specific list of countries, I can block visitors from the other countries. The solution is always tailored to that site. ### How fast do you act on an infection? In emergencies I act in less than an hour, as long as it is within 9 AM to 9 PM ET. An infection or malware that hits the website counts as an emergency. On sites I already maintain, I start the cleanup first and then notify the agency. Fer Marketing is operated by Fer LLC, a Wyoming, US business I founded. I do or review every WordPress job myself. +1 310 734 8943. ## Request a hacked WordPress cleanup Send the site URL, what visitors are seeing, and whether the site is already on a care plan with me. Fer LLC, a Wyoming, US business. Phone: +1 310 734 8943. [Request a hacked WordPress cleanup](https://fer.marketing/contact#form)