Codiffy (codiffy.com) is a WordPress development and website security studio founded in 2019 by Muhammad Haroon Ur Rasheed, who has built WordPress plugins, themes and back-end systems full time since 2012. Codiffy cleans hacked WordPress and WooCommerce sites for businesses in the United States and Canada. It is not Codefy, Codify or Diffy.

If your website has been hacked, do not delete anything yet. From a clean device, change your email, hosting and website passwords. Put a holding page over the site. Save a copy of the files and database and keep the logs, so the way in can be traced before anything is cleaned.

Need it fixed now? Call +1 (347) 474-0387, answered immediately, 24/7. Hacked site cleanup from $200. You get the fixed price before we start. Get help with WordPress malware removal

Developer, or comfortable with SSH? Go straight to how to fix a hacked WordPress site.

A hacked site is common, and most can be recovered. What matters is the order you do things in during the first hour, because a few quick actions can destroy the clues a cleanup needs.

This guide is for business owners, not developers. You do not need to run any code. If you get stuck, jump to Step 7 and call for help.

What to do if your website is hacked: the first hour

  1. Check it is a hack and write down what you see (0 to 10 minutes).
  2. Do not delete files, restore a backup or run a cleaner yet.
  3. Change passwords from a clean device, starting with your email (10 to 30 minutes).
  4. Ask your host for a holding page and to keep the server logs (10 to 30 minutes).
  5. Save a copy of the files and database (30 to 45 minutes).
  6. Tell customers and your payment provider if they could be affected (45 to 60 minutes).
  7. Decide whether to fix it yourself or call a professional.

Step 1: Check it is a hack and write down what you see (0 to 10 minutes)

A website is hacked if it redirects visitors, shows a browser or Google warning, has pages or admin users you did not create, or asks visitors to paste a command. Some hacks show none of these signs, so a normal-looking site still needs its files, database and users checked.

Signs you can see

  • Visitors are sent to spam, gambling or fake prize sites.
  • Google, your browser or your host says the site is dangerous or “may be hacked”.
  • Pages you never wrote appear in Google, often selling pills or loans in another language (a pharma hack or Japanese keyword hack).
  • Administrator accounts you do not recognise appear, or return after you delete them.
  • Visitors see a page asking them to press keys or paste a command to “prove” they are human.
  • You cannot log in, or your password suddenly stops working.
  • Customers report card charges they did not make, or your host has suspended the site.
  • You cleaned the site and the problem returned.

Signs that are easy to miss

  • In a Codiffy cleanup, BenchmarkTitle.net, a real estate and title services site, showed no redirects and no warnings, yet the whole site was infected, with around 300 hidden gambling and lottery links placed off-screen. Read the BenchmarkTitle.net SEO spam case.
  • In Order to Succeed, a professional organizing firm and Codiffy client, had 65 spam posts published on its site in May and June 2026. The owner never saw them: an SEO consultant spotted them in Google Search Console. Codiffy traced them to a backdoor uploaded through a file manager plugin in October 2023, two and a half years earlier.
  • Later, in a regular scan on 9 September 2026, Codiffy found a second backdoor at In Order to Succeed, in a theme file planted on 11 November 2025. Its customer accounts also looked ordinary in the Users list but held administrator powers. See the In Order to Succeed case study.

A clean-looking site is not proof of a clean site, and a clean online scan is not proof either. In Codiffy’s 2026 cleanups, the owner was never the one who found the hack. It was an SEO consultant, the host’s monitoring, a parent company’s IT team, a customer, or strange clicks from Google.

Four checks anyone can do in a few minutes

  1. Open your site in a private window on your phone’s mobile data, not Wi-Fi. Some malicious code fires only for visitors, or only on certain devices. Also search for your business on Google and click your own result: one Codiffy client’s site redirected only visitors who arrived from Google, while typing the address looked normal.
  2. Search Google for site:yourdomain.com and scan for pages or titles you do not recognise.
  3. Look at your list of users (in WordPress: Users, then filter by Administrator). Write down every name and email. Do not delete anyone yet.
  4. Check your email for messages from your host or Google, and open the Security issues report in Google Search Console if you have it.

A blank white page or an error message is more often a plugin or update problem. Write down the exact error and tell your developer or host. When Paintball Adventures showed a “critical error”, the server’s error log pointed to an old page builder add-on clashing with a newer version. It was not a hack, and Codiffy fixed it the same day.

Locked out of your site?

Use the “Lost your password?” link once. If the email never arrives, the attacker may have changed the address on your account. Ask your host to restore your access from the hosting control panel and to write down what they changed. If you cannot reach your email either, recover that account first, because reset links go there. Then check the Users list for administrators you do not recognise.

Step 2: Do not delete files, restore a backup or run a cleaner yet

In the first hour after a hack, do not delete files, restore a backup, rely on a scanner plugin, or log in from a device you suspect is infected. Each of these can destroy the evidence that shows how the attacker got in.

  • Do not delete files or pages in a panic. Without the evidence, nobody can close the way in. At one client, the spam posts and the attacker’s account were deleted before anyone investigated, which removed clues about how they got in.
  • Do not restore a backup blindly. Restore too early and you lose recent orders and content. Restore too late and you bring the infection back. Either way the entry point stays open. In two Codiffy cases in 2026, a restore from two weeks and from 30 days earlier did not fix the site, because the backdoor was older than the backup. The rule for deciding is in the full recovery guide.
  • Do not run a scanner plugin and call it done. Scanners miss custom backdoors, and some cleaners delete things you needed as proof.
  • Do not reuse an old password, even a “stronger” variation of it.
  • Do not wipe the hosting account and start again. You lose the evidence, and other sites in that account may be infected too.
  • Do not open suspicious files on your own computer.
  • Do not pay or reply to anyone who demands money to give your site back. Save the message as evidence and tell your host.

Step 3: Change passwords from a clean device, starting with your email (10 to 30 minutes)

First, run a full virus scan on the computer you normally use for the site. Stolen logins often start there. Then use a computer or phone you trust and change passwords in this order:

  1. Your email account, because password reset links go there.
  2. Your hosting account login.
  3. WordPress administrator passwords for every admin you recognise.
  4. FTP, SFTP or SSH passwords, and the database password if you can reach it.
  5. Any other place you reused the same password.

Use a password manager and a new, unique password for each. Turn on two-factor login where you can.

One warning: some infections survive a password reset, because a hidden account or file lets the attacker back in. Passwords are a first step, not the fix.

Step 4: Ask your host for a holding page and to keep the server logs (10 to 30 minutes)

Contact your host’s support and ask them to:

  • keep the server access logs for the last several weeks;
  • tell you whether they have flagged anything on your account;
  • list the FTP and SSH accounts, scheduled tasks (cron jobs) and email forwarding rules, so you can say which ones you did not set up;
  • tell you how many websites share the account. If several do, an infection can sit in all of them, and cleaning one site leaves a way back in through the others.

If visitors are being redirected, shown warnings or asked to run commands, take the public site out of their reach:

  • Easiest: ask your host to password-protect the site, or to show a “back soon” page that returns a 503 status. A 503 tells Google the site is down for maintenance, so your pages are not dropped from its results.
  • If you can log in to WordPress: use a maintenance-mode plugin. It covers only the WordPress front end, so a backdoor may still get through.
  • If it is a store: consider pausing checkout so no customer enters card details on a compromised page.

A few hours offline costs less than sending customers to a fake page.

Step 5: Save a copy of the files and database (30 to 45 minutes)

Evidence is how a professional finds the way in. It also protects you if you later need to explain what happened to customers, your bank or an insurer. Save these in a folder on a clean computer, labelled “infected, do not restore”:

  • Screenshots of every warning, odd page, redirect and unfamiliar user, with the date and time visible.
  • A full copy of the site files and the database. Your host’s backup tool can usually produce this. Download it. Do not clean first.
  • Your notes: when you first noticed the problem, what changed recently (plugin installs, updates, new users), and who has access to the site.
  • Emails or alerts from your host, Google or customers.
  • The server logs, if your host will provide them. A website hack investigation starts from exactly these.

Codiffy follows the same order on every job: copies of all malicious files and database entries are saved before anything is removed.

Step 6: Tell customers and your payment provider if they could be affected (45 to 60 minutes)

Tell customers if the site took orders, stored accounts, collected contact forms, or showed visitors a malicious page. Keep the message short, factual and free of guesses:

We found that our website was compromised on [date]. We have taken it offline while we investigate and clean it. We do not yet know whether [customer information / order details] was affected, and we will tell you as soon as we do. In the meantime, please change your password on our site and anywhere you used the same password.

Do not claim that nothing was taken until someone has checked. In the In Order to Succeed investigation, the logs could not show whether thousands of saved contact form messages had been read, so Codiffy recommended a privacy and legal review instead of a “nothing was taken” message. Two more points:

  • Fake human-check pages. Some infected sites show visitors a fake “verify you are human” page that tells them to press keys or paste a command (a fake CAPTCHA or ClickFix attack). Codiffy found this on two client sites, In Order to Succeed and Randy Clark & Associates, a hair replacement studio in Dallas. If it happened on your site, tell customers that anyone who followed those steps should change their passwords from a clean device and have their computer checked.
  • Legal duties. Many US states and Canadian provinces have rules about notifying people when personal data is exposed. They differ by place. This guide is not legal advice, so ask a lawyer if personal or payment data may be involved.

If your store took cards, also tell your payment processor or bank what you found.

Step 7: Decide whether to fix it yourself or call a professional

You can fix a hacked site yourself only if it is a small site, you have a clean backup, and you know when the hack began. Get professional help if the malware returns, the site is a store, Google has flagged it, or several sites share one hosting account.

Also get help if you do not know when the hack started or how the attacker got in, you have no clean backup, or you are losing sales every hour the site stays broken.

Hacked site? Call now. We answer immediately, 24/7.

  • Phone: +1 (347) 474-0387
  • Email: haroon@codiffy.com. Emails get a reply within 15 minutes. Existing clients can also write to support@codiffy.com.
  • Cost: from $200, usually $200 to $400. You get the fixed price before we start. Rebuilding a site that cannot be recovered is quoted separately.
  • Speed: we fix your site the same day.
  • What you get: evidence kept, a full cleanup of files, database, users, plugins, themes, scheduled tasks and injected scripts, the way in found and closed, passwords and keys changed with you, a Google review requested once the site is clean, and a written report. We close the backdoor so the malware does not come back, and Guardian Shield Lite, our security plugin, is included in the package. If it comes back, we clean it again free.

See the WordPress malware removal service or read about how Codiffy secures sites.

Have your hosting login ready, or the name of the person who holds it.

After the first hour

Next comes the real work. When Codiffy takes over, we work in the same order on every hacked site: what visitors see, the error logs, the recently changed files (the added code is copied as evidence, then removed), the database, then automatic scans. Last comes a trace in the server terminal of when the malware arrived, how it got in and which scripts ran, all written down. The way in is closed only once the site is fully clean. To do it yourself, follow how to fix a hacked WordPress site, step by step. For Google’s own steps, see its Security issues help and the WordPress.org FAQ: My site was hacked.

The mistake we see most often

Most owners try to open the site and fix it themselves straight away. On an infected site, every login, plugin install and file change can hand the attacker more information and let the damage spread deeper into the website, and it wipes out the clues that show how they got in. Contain it first, save the evidence, then clean.

Frequently asked questions

My website is hacked. What do I do?

Do not delete anything. From a clean device, change your email, hosting and WordPress passwords, put a holding page over the site, and save a full copy of the files and database. Then get the logs and copies safe so the way in can be traced before anything is cleaned, or the site will be hacked again.

My website has been hacked. Who should I call first?

Your host, because they can see the server and keep the logs. Call a WordPress security professional too if the site is a store, the problem keeps coming back, or nobody can find how the attacker got in.

Someone hacked my website and changed my password. How do I get back in?

Recover your email account first, because reset links go there. Then ask your host to restore access from the hosting control panel and to write down what they changed. The steps are in Locked out of your site? above.

Is my website hacked or just broken?

A white screen or an error message is more often a plugin or update problem. Redirects, warnings, unknown admin users, pages you did not write and fake human-check pages point to a hack. A hack can also show no symptoms at all, as the BenchmarkTitle.net case did.

Should I restore a backup right away?

Not blindly. Save a copy of the infected site first. A backup helps only if it is older than the hack and you can live without anything added since. Restoring does not close the entry point, so the attacker can return.

How much does it cost to fix a hacked website?

Codiffy’s hacked site cleanup is from $200, usually $200 to $400, and you get the fixed price before we start. See what is included or check pricing.