🚫 WordPress site hacked and disabled: step-by-step recovery plan

Your hoster blocked your site for sending spam, and the admin panel won't open. Panic familiar to anyone who's been administering WordPress for more than a year. Here's a step-by-step plan: from negotiating with tech support to manual cleanup on a local server.

The situation is complicated by the fact that the site is physically disconnected from the network. You can't log into the WordPress dashboard, run a familiar scanner like Wordfence, and click "clean". So the sequence here is reversed: first we regain access, then we deal with the infection.

💡 Quick overview:

• Contact your hoster: ask them to open the site behind an HTTP password and disable email sending, this gives you access for diagnostics without the risk of repeated spam blasts.
• If the hoster refuses to turn the site back on, spin up a copy locally using XAMPP or a similar stack, scan it with security plugins, and replace infected files with clean versions.
• After cleanup, change ALL passwords: FTP, database, hosting panel, WordPress admin accounts. Update the core, themes, and plugins to the latest versions.
• Set up basic protection: a firewall, login attempt limiting, two-factor authentication. Check your own computer for viruses, a common source of password leaks.

Why hosters disable hacked sites

It sounds harsh: you're a customer, you pay for hosting, and they just went and turned your site off. But the hoster's logic is simple and, if you think about it, reasonable.

A hacked WordPress site does two dangerous things. First, it sends spam through the hosting provider's mail server. Thousands of emails go out to random addresses, and the mail IP gets blacklisted. After that, ALL clients on that server stop delivering emails, and the hoster gets a flood of tickets from innocent users.

Second, the site turns into a distributor of malicious code. Visitors get served trojans, phishing forms, or hidden mining scripts. Google notices this within hours and slaps on a "This site may harm your computer" warning. After that, traffic drops to zero, and digging the site out of search engine blacklists is a whole separate saga.

The hoster disables an infected site not to punish you. They're protecting their infrastructure and the rest of their clients. You can negotiate with them, and that's the first step.

Step 1: negotiating with the hoster

Right after receiving the block notification, write to tech support and propose a compromise. Don't demand "turn it back on and that's it." Offer a concrete plan:

• Enable the site behind an HTTP password. This is a standard Apache/Nginx feature; when visiting the site, the browser asks for a login and password. Visitors and search engines don't see the site, but you do and can work with the admin panel.
• Disable the hosting mail function. If the spam went through PHP mail(), the hoster can temporarily block sending for your account. The risk of repeated mailings disappears, and the hoster feels more at ease.

In most cases, tech support cooperates. It's more profitable for the hoster to have you clean the site and remain a client than to lose a client and have a dead account on the server.

Got access behind a password? Proceed to cleanup (step 3). Couldn't reach an agreement? See step 2.

Step 2: recovery without site access

The hoster refuses to turn the site on, even behind a password. This happens with cheap shared plans or if the spam damage is already too great. You have three paths.

2.1. Local copy via XAMPP

Download the site archive through the hosting file manager (or request a backup from tech support) and export the database via phpMyAdmin. Deploy the copy on your local computer using XAMPP, LocalWP, or Laragon.

Then the standard procedure: install Wordfence, the most popular free scanner with malware signatures and a firewall. Run a full scan, delete any infected files found, or replace them with originals from a fresh WordPress distribution. Run Sucuri Scanner to check core integrity. Upload the cleaned site back to the hosting.

The method works, but it requires a basic understanding of how WordPress works under the hood.

2.2. List of infected files from the hoster

Ask tech support to send a list of files detected as malicious. Hosters often use ClamAV or a similar server-side tool and can see the specific files. Once you have the list, download those files via FTP, open them in an editor, and remove the suspicious insertions, usually obfuscated PHP code at the beginning or end of the file.

For WordPress core files and popular plugins, it's easier not to clean manually but to overwrite them with original versions from the official repository. After replacement, ask the hoster to re-scan the site and, if there are no threats, to open access.

2.3. Security specialist

If the infection is extensive and you don't have time to deal with it, hire a professional specialist. The cost of a one-time cleanup depends on complexity: basic scanning and malware removal ranges from one and a half to five hundred dollars. Services like Sucuri offer a "Cleanup & Protect" package with a guarantee and annual monitoring.

Tip: before contacting a specialist, still request a backup of files and database from the hoster. This is your data, and the hoster is obligated to provide it.

Step 3: cleaning the site after gaining access

You have admin panel access. Now methodically go through the checklist.

Full backup. Even an infected one. Copy all files via FTP and make a database dump. During the cleanup process, you can accidentally break something that was still working; a backup insures against fatal errors.

Scanning. Install Wordfence; the free version finds malware by signatures, checks theme and plugin files against the original from the repository. In parallel, run Sucuri Scanner, which specializes in core integrity checks. Two scanners find more than one.

Changing passwords. All of them, right away: WordPress admin accounts, FTP access, MySQL database user, hosting panel password. Generate long random passwords. Enable two-factor authentication for the admin panel; Wordfence does this out of the box.

Updating. Install the latest version of WordPress, update all plugins and themes. Delete unused plugins; each one is a potential entry point.

Step 4: protection against repeat hacking

Cleaned up, now lock it down so it doesn't happen again in a week.

• Site-level firewall. Wordfence includes a Web Application Firewall that blocks known attack vectors before they even reach WordPress. The free version is sufficient for non-typical projects.
• Login attempt limiting. Brute force is the most common hacking method. A plugin like Limit Login Attempts Reloaded blocks an IP after 3-5 failed attempts.
• Regular updates. Auto-updates for minor WordPress versions are enabled by default; for plugins and themes, set up notifications or use managed hosting with auto-updates.
• PC check. If the admin password leaked through a trojan on your computer, changing the password on the server won't help. Run an antivirus (Malwarebytes, the free version handles most threats) and check browser extensions.

A separate point: backups. Set up automatic backups, at least once a day. The UpdraftPlus plugin backs up for free to Google Drive, Dropbox, or a separate FTP. In the next incident, you'll restore the site in 10 minutes, not an entire evening.

⁉️🤔 Frequent questions

Is the hoster obligated to provide a backup of a hacked site?

Files and database are your content; the hoster has no right to withhold them. Tech support is obligated to provide an archive even from a blocked account. In practice, a request through the ticket system resolves the issue within a day.

Can I just reinstall WordPress and upload a backup?

No, because the infection often lives in the database or the uploads folder, not just in core files. A simple reinstall and substitution of the old database will most likely bring the infection back. You specifically need scanning and cleaning of the running site.

What if Google has flagged the site as dangerous?

After a complete cleanup, go to Google Search Console, find the "Security & Manual Actions" section, and request a review. Google will re-scan the site within 24-72 hours and remove the warning. A similar procedure exists in Bing Webmaster Tools.

Which security plugins are a must-install?

The minimum set for every site: Wordfence (firewall + scanner) and Limit Login Attempts Reloaded (brute force protection). This is enough to protect against mass automated attacks. If the site is commercial, add two-factor authentication and file integrity monitoring.

Will switching to managed hosting help?

Yes, managed WordPress hosting (Kinsta, WP Engine, SiteGround) handles a significant portion of security: server-level firewall, auto-updates, isolated containers. This doesn't eliminate basic site-level measures but reduces the likelihood of a hack and simplifies recovery.

Site hacked and disabled: final checklist

The sequence of actions fits into four points. Negotiate with the hoster for password-protected access. If not, spin up a copy locally and scan there. After cleanup, change passwords and update everything to the latest versions. Set up a firewall, brute force protection, and daily backups.

If the site is commercial and downtime is costly, consider switching to managed WordPress hosting or hire a specialist to set up layered defense.

How did you recover your site after a hoster block? Share your experience in the comments.