Hacked WordPress Site Rescue in Under 3 Hours

When a hacked website takes your business offline, every minute counts. This case study walks through how I restored a local Sunshine Coast company’s WordPress site after it was hijacked by a malicious redirect. If you’re dealing with something similar, this is exactly what an Emergency Website Rescue is.

The Situation

A local Sunshine Coast business woke up to a hacked website — here’s what happened

At 6:45am, the business owner noticed their homepage redirecting to a spam gambling site. Their WordPress login wasn’t accessible, their email forms were failing, and Chrome flagged their domain as “dangerous”.

This type of attack is common. WordPress powers over 40% of the internet, and outdated plugins or weak credentials leave many small-business sites vulnerable. But, with the right approach, a hacked website can be fully restored without losing SEO or customer trust.

The first sign of trouble: sudden redirects to a gambling site

Redirect malware is designed to push users somewhere else before a page loads. In this case, the attacker injected malicious code into the site’s files and modified the .htaccess rules to force every visitor over to the spam domain.

By the time the owner contacted me, Google had already begun flagging the site. If left for too long, this can tank search rankings — one of the reasons hacked sites need immediate attention.

Step 1: Emergency triage — securing access and preventing further damage

Before anything else, I focused on stopping the attacker from doing further damage. That included:

• Accessing the hosting panel (bypassing the broken admin login)
• Blocking malicious login attempts
• Resetting all credentials
• Cloning the site into a secure inspection environment
• Reviewing recent file changes for tampering
• Checking error logs and server activity

Hacked websites often have multiple entry points. Securing the environment first prevents reinfection while the clean-up begins.

If your site is down, hacked or behaving strangely, start with an Emergency Website Rescue — it’s the safest and fastest way to get things under control.

Step 2: Deep malware scan and manual cleanup

Automated scanners can highlight problems, but real malware cleanup requires digging into the actual code.

I located:

• Three corrupted PHP files in the theme
• A malicious script was injected into functions.php
• Multiple hidden backdoor files disguised as system components
• A rogue admin user created by the attacker
• A compromised .htaccess causing the redirects

Every infected file was cleaned manually or replaced with verified clean versions from the WordPress core repository.

With the infection removed, I ran a full security sweep, then checked load speeds and plugin health. Unoptimised sites are easier targets, so while working, I also reviewed the client’s performance setup — something I often address through Website Performance Rescue.

Step 3: Hardening the website and preventing future attacks

Once the site was clean, I moved straight into prevention. This included:

• Reinstalling core WordPress files
• Updating plugins and removing abandoned ones
• Setting correct file permissions
• Adding a firewall and login rate-limiting
• Configuring daily backups with off-site storage
• Enabling uptime monitoring so issues are caught instantly
• Setting up alerts for suspicious activity

This is all part of making sure the same problem doesn’t come back. Most hacked sites I rescue share the same pattern — outdated software, weak hosting setups, or no reliable backups.

To prevent it from happening again, the client chose one of my website maintenance plans.

The result: a fully restored website in under 3 hours

By mid-morning, the website was:

• Clean
• Live
• Secure
• Loading faster than before
• Free from redirect malware
• Ready for Google to clear the security warning

The relief was huge. The client regained control of their business, stopped losing enquiries, and avoided long-term SEO damage.

What businesses can learn from this hacked-site rescue

Here are the big takeaways:

1. A hacked website isn’t the end of the world.
With fast action, most WordPress infections can be safely removed without losing any data.

2. Outdated plugins are the #1 cause of WordPress attacks.
Regular maintenance is far cheaper than a clean-up job.

3. Backups are non-negotiable.
Without a clean backup, a hacked site can take much longer to restore.

4. Google penalties escalate fast.
Fixing the issue early prevents bigger problems like deindexing.

5. Prevention costs less than recovery.
A small monthly care plan keeps you protected, fast and secure.