What to do if your site has been compromised

Overview

We take security issues very seriously and want to make sure any concerns are addressed promptly. This article helps you determine whether your WordPress site has been compromised, walks you through cleaning it up, explains how to reduce the risk of a compromise, and covers what to gather before contacting our Support Team.

Note: This article is not intended for security researchers reporting a code vulnerability in Gravity Forms. If you have discovered a vulnerability, please review our How To Report a Security Issue and Information for Security Researchers articles, and see our Security Best Practices documentation for technical details.

How do I know if my site has been hacked?

Not every problem is a hack. A sudden white screen or fatal error immediately after an update is far more often a plugin or theme conflict, and unusual slowness is usually a hosting, caching, or plugin issue. Before assuming the worst, rule out those causes. That said, the more of the following signs you see, the more likely your site has been compromised:

  • Your website won’t load, or it displays server errors (such as a 500 Internal Server Error) that weren’t there before.
  • Your host has shut down or suspended your site, or has emailed you a notice that your site has been compromised or is sending spam.
  • You’ve received an alert from a security plugin you run, such as a file-change or malware notification.
  • You heard about it from a customer or visitor.
  • You see strange popups, ads, or spam content on the site that you didn’t add.
  • You can no longer log in with your usual username and password, even though you’re sure they’re correct.
  • A malware warning appears for your site in search engine results (for example, Google’s “This site may be hacked” or “This site may harm your computer”), or your browser shows a warning when you try to visit.
  • Your anti-virus software blocks you from visiting your own site.
  • Visiting your site redirects you to another website, often a spammy, adult, or pharmaceutical site. Sometimes this happens only for visitors arriving from search engines, not for logged-in users.
  • You notice a sudden drop in performance, or an unexplained drop in search traffic and rankings.
  • Parts of your site have been replaced with content you don’t recognize, or your homepage has been defaced.
  • Injected links appear in your footer or within your content, frequently linking to spammy or unrelated sites.
  • You find plugins, themes, or files you didn’t install. Attackers often use clever names to disguise them and place PHP files in unexpected places, such as the uploads folder.
  • Your WordPress core files have been modified.
  • If you accept payments, your payment gateway or payout information has changed, a strong sign that your site or account has been compromised.
  • There are administrator accounts in your WordPress users list that you don’t recognize. Some malware hides these accounts from the WordPress Users screen, so also check your database directly (for example, the wp_users table via phpMyAdmin in your hosting control panel). If the user count shown in your dashboard doesn’t match the number of accounts you can actually see, treat that as a red flag.

Note: Two quick, free ways to confirm a suspected hack: check the Security Issues report in Google Search Console (if Google has detected a compromise, it will tell you directly and often list affected URLs), and run your site through a free external scanner. Be aware that “your site has been hacked” emails are also common scams, so always verify with your hosting provider or a trusted security tool rather than clicking links in unsolicited emails.

Cleaning up a compromised site

Thoroughly cleaning a compromised site can be difficult because attackers often leave hidden backdoors that allow reinfection. If you aren’t confident working with server files and databases, the safest option is to have a professional handle it. Many reputable security services and web hosts offer malware scanning and cleanup. The guidance below is a general roadmap and is not a substitute for a detailed, step-by-step cleanup guide.

Stay calm and document everything.
Note what you’re seeing, when you first noticed it (and your time zone), and any recent changes, such as a plugin installed, a theme edited, or a widget changed. This becomes your incident record and will be invaluable whether you clean the site yourself or hand it to a professional.

Contact your host early.
Your hosting provider is often your strongest ally. They may be able to tell you when and how the intrusion occurred from their logs, whether other sites on the same server were affected, and whether they offer malware scanning or cleanup. Many hosts do.

Take the site offline temporarily.
Putting the site into maintenance mode (or password-protecting it) protects your visitors from malware and prevents further damage while you work.

Change every password, then change them again after cleanup.
This includes your WordPress admin accounts, hosting/cPanel, FTP/SFTP, and database credentials, and it should cover all users with access, not just you. Resetting your WordPress secret keys/salts in wp-config.php will also log out any attacker holding a live session. Remember to update the database password in wp-config.php if you change it. Change passwords again once the site is verified clean, in case they were captured mid-cleanup.

Remove unrecognized admin users.
Delete any administrator accounts you don’t recognize. If they reappear, that indicates a backdoor is recreating them, so you’ll need to find and remove the offending code, not just the account.

Scan the site.
Use both an external/remote scanner and an application-level scan (via a reputable security plugin), since each catches different things. A remote scanner checks what visitors and search engines see. A plugin-level scanner can compare your WordPress core, theme, and plugin files against known-good originals and flag any changes.

Restore from a known-clean backup if you have one.
This is frequently the fastest, most reliable recovery path, but only if the backup predates the compromise. Restoring alone does not close the hole that let the attacker in, so you still need to identify and fix the entry point to prevent reinfection.

Replace core, plugin, and theme files with fresh copies.
Download clean copies of WordPress core (matching your version) and of any plugins and themes, and overwrite the affected files. Never modify WordPress core files directly. If they’ve been altered, replacing them with fresh copies can remove injected code. Back up first, and be careful not to overwrite any legitimate customizations.

Check the database for injected content.
Malware can live in database tables (for example, injected spam in posts/options or rogue users) that file scanners won’t detect. Back up the database before making any changes.

Hunt down backdoors.
Look in commonly abused locations, such as the uploads folder (which should never contain PHP files), mu-plugins, and files disguised with names similar to legitimate ones. Leaving a single backdoor in place is the most common reason a site is reinfected within days.

Update everything and request reviews.
Once clean, update WordPress core, all plugins, and all themes. If Google (or another authority) flagged or blocklisted your site, and if your host suspended it, request a review or removal after confirming the site is clean. Then take a fresh, clean backup as your new baseline.

Preventing security issues

Keep everything updated.
Outdated plugins, themes, and WordPress core are among the most common causes of compromise. Keeping everything current is your single best defense. See our article on The Importance of Updates for details, and consider enabling automatic background updates for software you trust.

Use strong, unique passwords.
Weak or reused passwords are frequently the weakest link. Use long, random passwords (a password manager makes this easy) and never reuse them across accounts.

Enable two-factor authentication (2FA).
2FA is one of the highest-impact, lowest-effort protections available. Even if a password is stolen, an attacker still can’t log in without the second factor. Prefer an authenticator app over SMS.

Use a reputable security plugin and/or firewall.
A well-known security plugin can add login protection, file-change monitoring, and malware scanning, and a web application firewall (WAF) can block many attacks before they reach your site. Choose one primary security plugin rather than stacking several, as they can conflict.

Back up early, often, and off-site.
Reliable, tested, off-site backups are your ultimate safety net. They let you recover quickly if the worst happens.

Choose secure, well-maintained software and hosting.
Established, actively maintained plugins and themes have vulnerabilities discovered and patched quickly. Managed WordPress hosting can also handle much of the hardening, scanning, and backups for you.

For details on securing a WordPress site, see the WordPress.org guide on hardening WordPress, and our own Security Best Practices documentation.

Before you contact support

A site compromise is almost always a site-wide or server-level issue rather than something specific to Gravity Forms, so your hosting provider and (if you have one) your web developer are usually the right first point of contact. If you do believe the issue involves Gravity Forms specifically, gathering the following information first will help our Support Team assist you more quickly:

  • A clear description of what you’re seeing that leads you to believe the site is compromised, and when you first noticed it (including your time zone).
  • The exact text of any error messages or security warnings, and screenshots where possible.
  • Any recent changes to the site: plugins or themes installed or updated, code changes, or new users granted access.
  • Who else has access to the site (WordPress admins, developers, contractors) and at what permission level.
  • Your hosting provider, and whether they’ve contacted you or taken any action (such as suspending the site).
  • What steps you’ve already taken (password changes, scans, backups restored, files replaced).
  • Your Gravity Forms System Report, which contains the environment details we frequently need. You can copy it from your WordPress dashboard under Forms → System Status. If applicable, enable logging first, reproduce the issue, and include the log.

When you’re ready, you can open a support ticket. Please be as specific as possible so we can understand and resolve your issue efficiently.