{"id":27006,"date":"2026-10-20T09:00:00","date_gmt":"2026-10-20T06:00:00","guid":{"rendered":"https:\/\/weblab.gr\/?p=27006"},"modified":"2026-10-14T21:00:02","modified_gmt":"2026-10-14T18:00:02","slug":"hacked-wordpress","status":"publish","type":"post","link":"https:\/\/weblab.gr\/en\/hacked-wordpress\/","title":{"rendered":"Has your WordPress site been hacked? The first steps"},"content":{"rendered":"<p>One morning a customer writes to tell you that your site sent them to a casino page. Or you search for your business on Google and see dozens of pages with Japanese characters and drug names that you never created. A hacked WordPress site is stressful, but it\u2019s rarely a disaster, as long as the first steps are taken in the right order.<\/p>\n<p>Below is the order we follow ourselves on the sites we maintain: how to confirm the problem, what to do straight away, what to avoid, how the cleanup works, what applies to Google and the GDPR, and what changes afterwards.<\/p>\n<h2>How to tell your site has been hacked<\/h2>\n<p>The word \u201chacked\u201d doesn\u2019t say much. The <a href=\"https:\/\/wordpress.org\/documentation\/article\/faq-my-site-was-hacked\/\" target=\"_blank\" rel=\"noopener\">WordPress.org documentation<\/a> first asks you to describe the symptoms precisely, because they determine what you\u2019ll look for. The most common:<\/p>\n<ul>\n<li><strong>Redirects<\/strong> to spam, casino or fake store pages. They often happen only on mobile or only for visitors coming from Google, so the owner doesn\u2019t see them.<\/li>\n<li><strong>Spam pages on Google<\/strong>. In the search box, type <em>site:<\/em> and your domain. Pages in Japanese or with drug names mean someone is creating content on your site.<\/li>\n<li><strong>Unknown administrators<\/strong> among your WordPress users, or plugins you didn\u2019t install.<\/li>\n<li><strong>Warnings<\/strong>. Google shows the label \u201cThis site may be hacked\u201d in search results when it believes someone has changed pages or added unwanted ones (<a href=\"https:\/\/support.google.com\/websearch\/answer\/190597?hl=el\" target=\"_blank\" rel=\"noopener\">Google Search Help<\/a>). A warning may also appear in the browser, or visitors\u2019 antivirus may block the site.<\/li>\n<li><strong>Suspension by your hosting provider<\/strong> or bounced emails, because the server has ended up on a spam blocklist.<\/li>\n<\/ul>\n<h2>The first hour: six steps, in order<\/h2>\n<ol>\n<li><strong>Write down what you saw and when.<\/strong> The time, the symptoms, and what changed in the last few days: a new plugin, an update, a new user. You\u2019ll need it, and so will your developer and, if it comes to that, the Data Protection Authority.<\/li>\n<li><strong>Keep a copy of the infected state.<\/strong> Files and database, as they are. It sounds strange, but WordPress.org explicitly recommends it before the cleanup: if something goes wrong, you have a reference point and evidence of how the attack happened.<\/li>\n<li><strong>Tell your hosting provider.<\/strong> On shared hosting, the infection may affect other sites in the same account, and your host has logs you can\u2019t see.<\/li>\n<li><strong>Change all passwords, from a clean computer.<\/strong> Not just WordPress, but also the hosting panel, SFTP\/FTP, the database and the administrator\u2019s email. WordPress.org notes that the starting point is often an infected computer that steals passwords, so scan yours too.<\/li>\n<li><strong>Check the users.<\/strong> Under Users, filtered by \u201cAdministrator\u201d, every account should belong to someone you know. Record the unknown ones (name, email, date) and then remove them.<\/li>\n<li><strong>Protect your visitors.<\/strong> If the site is sending people to malicious pages, put it in maintenance mode or take it offline temporarily from the hosting panel until it\u2019s cleaned up.<\/li>\n<\/ol>\n<div class=\"art-note\">Passwords are changed twice: now, to lock down access, and again once the site is clean. If hidden malicious code remains, it can capture the new ones too.<\/div>\n<h2>What not to do<\/h2>\n<ul>\n<li><strong>Don\u2019t delete files blindly.<\/strong> You lose evidence of how the attack happened, and the backdoor is usually somewhere else.<\/li>\n<li><strong>Don\u2019t restore a backup and forget about it.<\/strong> If the hole they exploited, such as an outdated plugin, is still there, the infection will come back.<\/li>\n<li><strong>Don\u2019t rely on reinstalling from wp-admin.<\/strong> WordPress.org explains that it replaces the existing files but doesn\u2019t delete the new ones the attacker added.<\/li>\n<li><strong>Don\u2019t install \u201ccleaners\u201d from unknown sources<\/strong> and never nulled, that is \u201ccracked\u201d, versions of premium plugins and themes. They often come with malicious code built in.<\/li>\n<li><strong>Don\u2019t ask Google for a review before you\u2019re done.<\/strong> Google warns that premature or repeated requests can delay later ones.<\/li>\n<\/ul>\n<h2>How to clean up a hacked WordPress site<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-katharismos-scaled.jpg\" alt=\"Hands on a keyboard in front of screens showing code\" width=\"2560\" height=\"1707\" class=\"size-full wp-image-27044\" srcset=\"https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-katharismos-scaled.jpg 2560w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-katharismos-300x200.jpg 300w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-katharismos-1024x683.jpg 1024w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-katharismos-768x512.jpg 768w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-katharismos-1536x1024.jpg 1536w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-katharismos-2048x1365.jpg 2048w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-katharismos-18x12.jpg 18w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-katharismos-900x600.jpg 900w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-katharismos-1600x1067.jpg 1600w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-katharismos-600x400.jpg 600w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/><br \/>\nThere are two routes, and they\u2019re often combined.<\/p>\n<table>\n<thead>\n<tr>\n<th>Route<\/th>\n<th>When it fits<\/th>\n<th>What to watch out for<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Restoring a clean backup<\/td>\n<td>You know roughly when the infection started and have a backup from before then, kept off the server<\/td>\n<td>Anything that changed since then is lost, e.g. orders. The security hole must be closed immediately.<\/td>\n<\/tr>\n<tr>\n<td>Manual cleanup<\/td>\n<td>There\u2019s no reliable backup or the infection is old<\/td>\n<td>It takes time and experience, because files and the database have to be checked.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>In a manual cleanup, the order is roughly this:<\/p>\n<ul>\n<li><strong>Core.<\/strong> Replace the <em>wp-admin<\/em> and <em>wp-includes<\/em> folders with clean files of the same version, over SFTP. With WP-CLI, the command <a href=\"https:\/\/developer.wordpress.org\/cli\/commands\/core\/verify-checksums\/\" target=\"_blank\" rel=\"noopener\">wp core verify-checksums<\/a> compares the files with WordPress.org\u2019s official checksums, and with the <em>&#8211;include-root<\/em> option it warns about anything in the root folder that doesn\u2019t belong to WordPress.<\/li>\n<li><strong>Plugins and themes.<\/strong> Download them again from wordpress.org or from your account with the vendor, never from \u201cfree\u201d copies. Delete anything you don\u2019t use.<\/li>\n<li><strong>Uploads and \u201cfavorite\u201d files.<\/strong> PHP files inside <em>wp-content\/uploads<\/em> have no business being there. Pay particular attention to <em>.htaccess<\/em>, <em>index.php<\/em> and to <em>header.php<\/em>, <em>footer.php<\/em> and <em>functions.php<\/em> in the theme, which WordPress.org lists as common targets.<\/li>\n<li><strong>Database.<\/strong> Scripts hidden in posts, widgets and settings, and administrators created directly in the database.<\/li>\n<li><strong>New security keys (salts).<\/strong> Change them in <em>wp-config.php<\/em>, so that anyone still logged in is logged out, and then change all passwords again.<\/li>\n<\/ul>\n<p>Finally, update WordPress, plugins and the theme, and find out how the attacker got in. Without this step, the cleanup is only temporary.<\/p>\n<h2>Google: warnings and review requests<\/h2>\n<p>If Google has detected the problem, you\u2019ll see it in the <a href=\"https:\/\/support.google.com\/webmasters\/answer\/9044101\" target=\"_blank\" rel=\"noopener\">Search Console \u201cSecurity issues\u201d report<\/a>. There are three categories: hacked content, malware and unwanted software, and social engineering, such as fake login pages. The report also gives example URLs, which are useful for the cleanup.<\/p>\n<p>When the site is clean on every page, not just the ones listed, click \u201cRequest Review\u201d and describe the problem, what you did and what the result was. According to Google, the review takes from a few days to a few weeks. Don\u2019t send a new request while the previous one is pending. If the site wasn\u2019t verified in Search Console, do it now: that\u2019s where the warning gets removed.<\/p>\n<p>After the cleanup, the spam pages that were created should return a 404 or 410 error, so that they gradually drop out of the results.<\/p>\n<h2>GDPR: when to notify the Data Protection Authority<\/h2>\n<p>If the site holds personal data, such as customer accounts, orders, form messages or a newsletter list, and the attacker may have had access to it, this is a personal data breach. Under Article 33 of the GDPR, your business, as the controller, must notify the Hellenic Data Protection Authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to the people concerned (<a href=\"https:\/\/www.edpb.europa.eu\/sme-data-protection-guide\/data-breaches_el\" target=\"_blank\" rel=\"noopener\">European Data Protection Board guide<\/a>).<\/p>\n<ul>\n<li>If you don\u2019t have all the details within the 72 hours, make an initial notification and add the rest as you go.<\/li>\n<li>Every breach is recorded in an internal register, even if it doesn\u2019t need to be notified.<\/li>\n<li>If the risk is high, you also inform the people themselves (Article 34), preferably individually rather than with a general announcement.<\/li>\n<\/ul>\n<p>The <a href=\"https:\/\/www.dpa.gr\/el\/foreis\/asfaleia_dedomenwn\/gnwstopoiisi_paraviasis\" target=\"_blank\" rel=\"noopener\">Authority\u2019s breach notification page<\/a> also has a self-assessment tool, which it recommends you use before notifying. In an e-shop where payment happens on the bank\u2019s page, card details as a rule don\u2019t pass through your site. Customers\u2019 names, addresses and phone numbers, however, are in the database. Assessing the risk is a legal decision, so bring in your data protection officer or lawyer from day one. Your developer provides the facts: what changed, when, and whether there are signs the database was accessed.<\/p>\n<h2>How to stop it happening again<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-2fa-scaled.jpg\" alt=\"Phone with fingerprint verification above a keyboard\" width=\"2560\" height=\"1280\" class=\"size-full wp-image-27042\" srcset=\"https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-2fa-scaled.jpg 2560w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-2fa-300x150.jpg 300w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-2fa-1024x512.jpg 1024w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-2fa-768x384.jpg 768w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-2fa-1536x768.jpg 1536w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-2fa-2048x1024.jpg 2048w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-2fa-18x9.jpg 18w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-2fa-1600x800.jpg 1600w, https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-2fa-600x300.jpg 600w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/><br \/>\nThe data shows clearly where the risk comes from. According to <a href=\"https:\/\/patchstack.com\/whitepaper\/state-of-wordpress-security-in-2026\/\" target=\"_blank\" rel=\"noopener\">Patchstack\u2019s report on WordPress security<\/a>, 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025: 91% in plugins, 9% in themes and just 6, all low priority, in core. For 46% there was no fix from the developer at the time of disclosure, and the weighted median time to first exploitation was 5 hours. The pace isn\u2019t slowing: in the week of 28 September \u2013 4 October 2026 alone, <a href=\"https:\/\/www.wordfence.com\/blog\/2026\/10\/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-28-2026-to-october-4-2026\/\" target=\"_blank\" rel=\"noopener\">Wordfence recorded<\/a> 510 vulnerabilities in 370 plugins and 10 themes.<\/p>\n<ul>\n<li><strong>Updates without delay<\/strong>, ideally tested on staging first. When attacks on a new vulnerability start within hours, updating \u201conce a month\u201d isn\u2019t enough for critical ones.<\/li>\n<li><strong>Fewer plugins.<\/strong> Delete anything you don\u2019t use, don\u2019t just deactivate it. Replace any that their developer has abandoned.<\/li>\n<li><strong>Two-factor authentication (2FA)<\/strong> for every administrator, with unique, long passwords.<\/li>\n<li><strong>Least privilege.<\/strong> Whoever writes posts is an Editor, whoever manages orders a Shop Manager. Administrator accounts only for those who really need them.<\/li>\n<li><strong>A firewall that \u201cunderstands\u201d WordPress.<\/strong> In Patchstack\u2019s tests with hosting providers, standard server defenses blocked just 12% to 26% of attacks on vulnerabilities, depending on the experiment. An application-level WAF helps, but it doesn\u2019t replace updates.<\/li>\n<li><strong>Off-server backups, tested.<\/strong> A backup you\u2019ve never restored is an assumption, not a plan. Keep several days\u2019 worth, because an infection may only be detected weeks later.<\/li>\n<\/ul>\n<p>If your site is already showing any of the <a href=\"\/en\/website-maintenance-signs\/\">signs that it needs maintenance<\/a>, don\u2019t wait for the hack. In our <a href=\"\/en\/services\/website-maintenance\/#plans\">maintenance plans<\/a>, Grow includes staging and daily off-server backups, and Scale includes unlimited hack cleanup and a response within 4 hours, 24\/7, for critical issues. You can <a href=\"\/en\/maintenance-plan\/\">choose the plan that suits you<\/a> or, if you\u2019d like an overview first, request a <a href=\"\/en\/services\/technical-audit\/\">technical audit<\/a> with a security and malware check.<\/p>\n<h2>FAQ<\/h2>\n<h3>Will I lose my Google rankings?<\/h3>\n<p>While there are warnings and spam pages, traffic usually drops, because users avoid the site. After the cleanup and the review, things gradually recover. How quickly depends mainly on how long the problem lasted.<\/p>\n<h3>Is a security plugin enough?<\/h3>\n<p>It helps detect and block known attacks, but it doesn\u2019t update a vulnerable plugin or change a leaked password. It\u2019s one layer of protection, not the solution.<\/p>\n<h3>Can I clean it up myself?<\/h3>\n<p>If the infection is simple and you have a clean backup, yes, with the steps above. But if you have an e-shop, customer data or a warning from Google, it\u2019s worth having someone experienced look at it. One missed backdoor means a new infection within days. For immediate help, <a href=\"\/en\/contact\/\">contact us<\/a>.<\/p>\n<div class=\"art-sources\">\n<p class=\"art-sources-title\">Sources<\/p>\n<ol>\n<li><a href=\"https:\/\/patchstack.com\/whitepaper\/state-of-wordpress-security-in-2026\/\" target=\"_blank\" rel=\"noopener\">State of WordPress Security in 2026<\/a> \u00b7 Patchstack \u00b7 updated 25 Feb 2026<\/li>\n<li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/10\/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-28-2026-to-october-4-2026\/\" target=\"_blank\" rel=\"noopener\">Wordfence Intelligence Weekly WordPress Vulnerability Report (September 28, 2026 to October 4, 2026)<\/a> \u00b7 Wordfence \u00b7 9 Oct 2026<\/li>\n<li><a href=\"https:\/\/wordpress.org\/documentation\/article\/faq-my-site-was-hacked\/\" target=\"_blank\" rel=\"noopener\">FAQ My site was hacked<\/a> \u00b7 WordPress.org \u00b7 updated 26 Jul 2026<\/li>\n<li><a href=\"https:\/\/developer.wordpress.org\/cli\/commands\/core\/verify-checksums\/\" target=\"_blank\" rel=\"noopener\">wp core verify-checksums<\/a> \u00b7 WordPress Developer Resources \u00b7 updated 14 Oct 2026<\/li>\n<li><a href=\"https:\/\/support.google.com\/webmasters\/answer\/9044101\" target=\"_blank\" rel=\"noopener\">Security issues report<\/a> \u00b7 Google Search Console Help \u00b7 accessed 14 Oct 2026<\/li>\n<li><a href=\"https:\/\/support.google.com\/websearch\/answer\/190597?hl=el\" target=\"_blank\" rel=\"noopener\">Report a problem with Google Search (section \u201cThis site may be hacked\u201d)<\/a> \u00b7 Google \u00b7 accessed 14 Oct 2026<\/li>\n<li><a href=\"https:\/\/www.edpb.europa.eu\/sme-data-protection-guide\/data-breaches_el\" target=\"_blank\" rel=\"noopener\">Data breaches \u2013 Data protection guide for small business<\/a> \u00b7 European Data Protection Board (EDPB) \u00b7 accessed 14 Oct 2026<\/li>\n<li><a href=\"https:\/\/www.dpa.gr\/el\/foreis\/asfaleia_dedomenwn\/gnwstopoiisi_paraviasis\" target=\"_blank\" rel=\"noopener\">Notification of personal data breaches, Articles 33-34 GDPR (in Greek)<\/a> \u00b7 Hellenic Data Protection Authority \u00b7 accessed 14 Oct 2026<\/li>\n<\/ol>\n<p class=\"art-credits\">Cover photo: <a href=\"https:\/\/www.freepik.com\/free-photo\/another-difficult-conversation-with-customer_17291016.htm\" target=\"_blank\" rel=\"noopener\">gpointstudio on Freepik<\/a><\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>What to do in the first hour, what not to do, and how to stop it happening again.<\/p>","protected":false},"author":1,"featured_media":27043,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[25],"tags":[],"class_list":["post-27006","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-asfaleia"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>\u03a7\u03b1\u03ba\u03b1\u03c1\u03b9\u03c3\u03bc\u03ad\u03bd\u03bf WordPress site: \u03c4\u03b9 \u03ba\u03ac\u03bd\u03b5\u03c4\u03b5 \u03c0\u03c1\u03ce\u03c4\u03b1 \u00b7 web.lab<\/title>\n<meta name=\"description\" content=\"\u03a7\u03b1\u03ba\u03b1\u03c1\u03b9\u03c3\u03bc\u03ad\u03bd\u03bf WordPress site; \u03a4\u03b9 \u03ba\u03ac\u03bd\u03b5\u03c4\u03b5 \u03c4\u03b7\u03bd \u03c0\u03c1\u03ce\u03c4\u03b7 \u03ce\u03c1\u03b1, \u03c0\u03ce\u03c2 \u03ba\u03b1\u03b8\u03b1\u03c1\u03af\u03b6\u03b5\u03c4\u03b1\u03b9, \u03c4\u03b9 \u03b9\u03c3\u03c7\u03cd\u03b5\u03b9 \u03b3\u03b9\u03b1 Google \u03ba\u03b1\u03b9 GDPR \u03ba\u03b1\u03b9 \u03c0\u03ce\u03c2 \u03b4\u03b5\u03bd \u03be\u03b1\u03bd\u03b1\u03c3\u03c5\u03bc\u03b2\u03b1\u03af\u03bd\u03b5\u03b9. \u0394\u03b5\u03af\u03c4\u03b5 \u03c4\u03b1 \u03b2\u03ae\u03bc\u03b1\u03c4\u03b1.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/weblab.gr\/en\/hacked-wordpress\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u03a7\u03b1\u03ba\u03b1\u03c1\u03af\u03c3\u03c4\u03b7\u03ba\u03b5 \u03c4\u03bf site \u03c3\u03b1\u03c2; \u03a4\u03b9 \u03ba\u03ac\u03bd\u03b5\u03c4\u03b5 \u03c4\u03b7\u03bd \u03c0\u03c1\u03ce\u03c4\u03b7 \u03ce\u03c1\u03b1\" \/>\n<meta property=\"og:description\" content=\"\u039c\u03b7 \u03c3\u03b2\u03ae\u03c3\u03b5\u03c4\u03b5 \u03c4\u03af\u03c0\u03bf\u03c4\u03b1 \u03b2\u03b9\u03b1\u03c3\u03c4\u03b9\u03ba\u03ac. \u03a4\u03b1 \u03b2\u03ae\u03bc\u03b1\u03c4\u03b1 \u03b3\u03b9\u03b1 \u03c4\u03b7\u03bd \u03c0\u03c1\u03ce\u03c4\u03b7 \u03ce\u03c1\u03b1, \u03c4\u03bf\u03bd \u03ba\u03b1\u03b8\u03b1\u03c1\u03b9\u03c3\u03bc\u03cc, \u03c4\u03b7\u03bd \u03c0\u03c1\u03bf\u03b5\u03b9\u03b4\u03bf\u03c0\u03bf\u03af\u03b7\u03c3\u03b7 \u03c4\u03b7\u03c2 Google \u03ba\u03b1\u03b9 \u03c4\u03b7\u03bd \u03c0\u03c1\u03bf\u03b8\u03b5\u03c3\u03bc\u03af\u03b1 \u03c4\u03c9\u03bd 72 \u03c9\u03c1\u03ce\u03bd \u03c4\u03bf\u03c5 GDPR.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/weblab.gr\/en\/hacked-wordpress\/\" \/>\n<meta property=\"og:site_name\" content=\"web.lab\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/weblab.gr\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-20T06:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-cover-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1709\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Web Lab\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Web Lab\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/weblab.gr\\\/hacked-wordpress\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/weblab.gr\\\/hacked-wordpress\\\/\"},\"author\":{\"name\":\"Web Lab\",\"@id\":\"https:\\\/\\\/weblab.gr\\\/#\\\/schema\\\/person\\\/4bc18a0f5f7db99c0900da02c41d6b7c\"},\"headline\":\"\u03a7\u03b1\u03ba\u03b1\u03c1\u03af\u03c3\u03c4\u03b7\u03ba\u03b5 \u03c4\u03bf WordPress site \u03c3\u03b1\u03c2; \u03a4\u03b1 \u03c0\u03c1\u03ce\u03c4\u03b1 \u03b2\u03ae\u03bc\u03b1\u03c4\u03b1\",\"datePublished\":\"2026-10-20T06:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/weblab.gr\\\/hacked-wordpress\\\/\"},\"wordCount\":216,\"publisher\":{\"@id\":\"https:\\\/\\\/weblab.gr\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/weblab.gr\\\/hacked-wordpress\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/weblab.gr\\\/wp-content\\\/uploads\\\/2026\\\/12\\\/hacked-wordpress-cover-scaled.jpg\",\"articleSection\":[\"\u0391\u03c3\u03c6\u03ac\u03bb\u03b5\u03b9\u03b1\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/weblab.gr\\\/hacked-wordpress\\\/\",\"url\":\"https:\\\/\\\/weblab.gr\\\/hacked-wordpress\\\/\",\"name\":\"\u03a7\u03b1\u03ba\u03b1\u03c1\u03b9\u03c3\u03bc\u03ad\u03bd\u03bf WordPress site: \u03c4\u03b9 \u03ba\u03ac\u03bd\u03b5\u03c4\u03b5 \u03c0\u03c1\u03ce\u03c4\u03b1 \u00b7 web.lab\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/weblab.gr\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/weblab.gr\\\/hacked-wordpress\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/weblab.gr\\\/hacked-wordpress\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/weblab.gr\\\/wp-content\\\/uploads\\\/2026\\\/12\\\/hacked-wordpress-cover-scaled.jpg\",\"datePublished\":\"2026-10-20T06:00:00+00:00\",\"description\":\"\u03a7\u03b1\u03ba\u03b1\u03c1\u03b9\u03c3\u03bc\u03ad\u03bd\u03bf WordPress site; \u03a4\u03b9 \u03ba\u03ac\u03bd\u03b5\u03c4\u03b5 \u03c4\u03b7\u03bd \u03c0\u03c1\u03ce\u03c4\u03b7 \u03ce\u03c1\u03b1, \u03c0\u03ce\u03c2 \u03ba\u03b1\u03b8\u03b1\u03c1\u03af\u03b6\u03b5\u03c4\u03b1\u03b9, \u03c4\u03b9 \u03b9\u03c3\u03c7\u03cd\u03b5\u03b9 \u03b3\u03b9\u03b1 Google \u03ba\u03b1\u03b9 GDPR \u03ba\u03b1\u03b9 \u03c0\u03ce\u03c2 \u03b4\u03b5\u03bd \u03be\u03b1\u03bd\u03b1\u03c3\u03c5\u03bc\u03b2\u03b1\u03af\u03bd\u03b5\u03b9. \u0394\u03b5\u03af\u03c4\u03b5 \u03c4\u03b1 \u03b2\u03ae\u03bc\u03b1\u03c4\u03b1.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/weblab.gr\\\/hacked-wordpress\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/weblab.gr\\\/hacked-wordpress\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/weblab.gr\\\/hacked-wordpress\\\/#primaryimage\",\"url\":\"https:\\\/\\\/weblab.gr\\\/wp-content\\\/uploads\\\/2026\\\/12\\\/hacked-wordpress-cover-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/weblab.gr\\\/wp-content\\\/uploads\\\/2026\\\/12\\\/hacked-wordpress-cover-scaled.jpg\",\"width\":2560,\"height\":1709,\"caption\":\"Another difficult conversation with a customer\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/weblab.gr\\\/hacked-wordpress\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u0391\u03c1\u03c7\u03b9\u03ba\u03ae\",\"item\":\"https:\\\/\\\/weblab.gr\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u03a7\u03b1\u03ba\u03b1\u03c1\u03af\u03c3\u03c4\u03b7\u03ba\u03b5 \u03c4\u03bf WordPress site \u03c3\u03b1\u03c2; \u03a4\u03b1 \u03c0\u03c1\u03ce\u03c4\u03b1 \u03b2\u03ae\u03bc\u03b1\u03c4\u03b1\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/weblab.gr\\\/#website\",\"url\":\"https:\\\/\\\/weblab.gr\\\/\",\"name\":\"web.lab\",\"description\":\"\u0399\u03c3\u03c4\u03bf\u03c3\u03b5\u03bb\u03af\u03b4\u03b5\u03c2, e-shops \u03ba\u03b1\u03b9 web \u03b5\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ad\u03c2\",\"publisher\":{\"@id\":\"https:\\\/\\\/weblab.gr\\\/#organization\"},\"alternateName\":\"Web Lab\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/weblab.gr\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/weblab.gr\\\/#organization\",\"name\":\"Web Lab\",\"url\":\"https:\\\/\\\/weblab.gr\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/weblab.gr\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/weblab.gr\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/weblab-logo-square-800.png\",\"contentUrl\":\"https:\\\/\\\/weblab.gr\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/weblab-logo-square-800.png\",\"width\":800,\"height\":800,\"caption\":\"Web Lab\"},\"image\":{\"@id\":\"https:\\\/\\\/weblab.gr\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/weblab.gr\\\/\",\"https:\\\/\\\/www.instagram.com\\\/weblab.gr\\\/\",\"https:\\\/\\\/www.trustpilot.com\\\/review\\\/weblab.gr\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/weblab.gr\\\/#\\\/schema\\\/person\\\/4bc18a0f5f7db99c0900da02c41d6b7c\",\"name\":\"Web Lab\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/0e2171d3da32378d8c2c90eddd672370111e435cae3664b78f32000871842c78?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/0e2171d3da32378d8c2c90eddd672370111e435cae3664b78f32000871842c78?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/0e2171d3da32378d8c2c90eddd672370111e435cae3664b78f32000871842c78?s=96&d=mm&r=g\",\"caption\":\"Web Lab\"},\"sameAs\":[\"https:\\\/\\\/woocommerce-702740-6724867.cloudwaysapps.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hacked WordPress site: what to do first \u00b7 web.lab","description":"Hacked WordPress site? What to do in the first hour, how to clean it up, what applies to Google and the GDPR, and how to stop it happening again.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/weblab.gr\/en\/hacked-wordpress\/","og_locale":"en_US","og_type":"article","og_title":"\u03a7\u03b1\u03ba\u03b1\u03c1\u03af\u03c3\u03c4\u03b7\u03ba\u03b5 \u03c4\u03bf site \u03c3\u03b1\u03c2; \u03a4\u03b9 \u03ba\u03ac\u03bd\u03b5\u03c4\u03b5 \u03c4\u03b7\u03bd \u03c0\u03c1\u03ce\u03c4\u03b7 \u03ce\u03c1\u03b1","og_description":"\u039c\u03b7 \u03c3\u03b2\u03ae\u03c3\u03b5\u03c4\u03b5 \u03c4\u03af\u03c0\u03bf\u03c4\u03b1 \u03b2\u03b9\u03b1\u03c3\u03c4\u03b9\u03ba\u03ac. \u03a4\u03b1 \u03b2\u03ae\u03bc\u03b1\u03c4\u03b1 \u03b3\u03b9\u03b1 \u03c4\u03b7\u03bd \u03c0\u03c1\u03ce\u03c4\u03b7 \u03ce\u03c1\u03b1, \u03c4\u03bf\u03bd \u03ba\u03b1\u03b8\u03b1\u03c1\u03b9\u03c3\u03bc\u03cc, \u03c4\u03b7\u03bd \u03c0\u03c1\u03bf\u03b5\u03b9\u03b4\u03bf\u03c0\u03bf\u03af\u03b7\u03c3\u03b7 \u03c4\u03b7\u03c2 Google \u03ba\u03b1\u03b9 \u03c4\u03b7\u03bd \u03c0\u03c1\u03bf\u03b8\u03b5\u03c3\u03bc\u03af\u03b1 \u03c4\u03c9\u03bd 72 \u03c9\u03c1\u03ce\u03bd \u03c4\u03bf\u03c5 GDPR.","og_url":"https:\/\/weblab.gr\/en\/hacked-wordpress\/","og_site_name":"web.lab","article_publisher":"https:\/\/www.facebook.com\/weblab.gr\/","article_published_time":"2026-10-20T06:00:00+00:00","og_image":[{"width":2560,"height":1709,"url":"https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-cover-scaled.jpg","type":"image\/jpeg"}],"author":"Web Lab","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Web Lab","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/weblab.gr\/hacked-wordpress\/#article","isPartOf":{"@id":"https:\/\/weblab.gr\/hacked-wordpress\/"},"author":{"name":"Web Lab","@id":"https:\/\/weblab.gr\/#\/schema\/person\/4bc18a0f5f7db99c0900da02c41d6b7c"},"headline":"\u03a7\u03b1\u03ba\u03b1\u03c1\u03af\u03c3\u03c4\u03b7\u03ba\u03b5 \u03c4\u03bf WordPress site \u03c3\u03b1\u03c2; \u03a4\u03b1 \u03c0\u03c1\u03ce\u03c4\u03b1 \u03b2\u03ae\u03bc\u03b1\u03c4\u03b1","datePublished":"2026-10-20T06:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/weblab.gr\/hacked-wordpress\/"},"wordCount":216,"publisher":{"@id":"https:\/\/weblab.gr\/#organization"},"image":{"@id":"https:\/\/weblab.gr\/hacked-wordpress\/#primaryimage"},"thumbnailUrl":"https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-cover-scaled.jpg","articleSection":["\u0391\u03c3\u03c6\u03ac\u03bb\u03b5\u03b9\u03b1"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/weblab.gr\/hacked-wordpress\/","url":"https:\/\/weblab.gr\/hacked-wordpress\/","name":"Hacked WordPress site: what to do first \u00b7 web.lab","isPartOf":{"@id":"https:\/\/weblab.gr\/#website"},"primaryImageOfPage":{"@id":"https:\/\/weblab.gr\/hacked-wordpress\/#primaryimage"},"image":{"@id":"https:\/\/weblab.gr\/hacked-wordpress\/#primaryimage"},"thumbnailUrl":"https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-cover-scaled.jpg","datePublished":"2026-10-20T06:00:00+00:00","description":"Hacked WordPress site? What to do in the first hour, how to clean it up, what applies to Google and the GDPR, and how to stop it happening again.","breadcrumb":{"@id":"https:\/\/weblab.gr\/hacked-wordpress\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/weblab.gr\/hacked-wordpress\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/weblab.gr\/hacked-wordpress\/#primaryimage","url":"https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-cover-scaled.jpg","contentUrl":"https:\/\/weblab.gr\/wp-content\/uploads\/2026\/12\/hacked-wordpress-cover-scaled.jpg","width":2560,"height":1709,"caption":"Another difficult conversation with a customer"},{"@type":"BreadcrumbList","@id":"https:\/\/weblab.gr\/hacked-wordpress\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u0391\u03c1\u03c7\u03b9\u03ba\u03ae","item":"https:\/\/weblab.gr\/"},{"@type":"ListItem","position":2,"name":"\u03a7\u03b1\u03ba\u03b1\u03c1\u03af\u03c3\u03c4\u03b7\u03ba\u03b5 \u03c4\u03bf WordPress site \u03c3\u03b1\u03c2; \u03a4\u03b1 \u03c0\u03c1\u03ce\u03c4\u03b1 \u03b2\u03ae\u03bc\u03b1\u03c4\u03b1"}]},{"@type":"WebSite","@id":"https:\/\/weblab.gr\/#website","url":"https:\/\/weblab.gr\/","name":"web.lab","description":"\u0399\u03c3\u03c4\u03bf\u03c3\u03b5\u03bb\u03af\u03b4\u03b5\u03c2, e-shops \u03ba\u03b1\u03b9 web \u03b5\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ad\u03c2","publisher":{"@id":"https:\/\/weblab.gr\/#organization"},"alternateName":"Web Lab","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/weblab.gr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/weblab.gr\/#organization","name":"Web Lab","url":"https:\/\/weblab.gr\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/weblab.gr\/#\/schema\/logo\/image\/","url":"https:\/\/weblab.gr\/wp-content\/uploads\/2026\/10\/weblab-logo-square-800.png","contentUrl":"https:\/\/weblab.gr\/wp-content\/uploads\/2026\/10\/weblab-logo-square-800.png","width":800,"height":800,"caption":"Web Lab"},"image":{"@id":"https:\/\/weblab.gr\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/weblab.gr\/","https:\/\/www.instagram.com\/weblab.gr\/","https:\/\/www.trustpilot.com\/review\/weblab.gr"]},{"@type":"Person","@id":"https:\/\/weblab.gr\/#\/schema\/person\/4bc18a0f5f7db99c0900da02c41d6b7c","name":"Web Lab","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/0e2171d3da32378d8c2c90eddd672370111e435cae3664b78f32000871842c78?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/0e2171d3da32378d8c2c90eddd672370111e435cae3664b78f32000871842c78?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0e2171d3da32378d8c2c90eddd672370111e435cae3664b78f32000871842c78?s=96&d=mm&r=g","caption":"Web Lab"},"sameAs":["https:\/\/woocommerce-702740-6724867.cloudwaysapps.com"]}]}},"_links":{"self":[{"href":"https:\/\/weblab.gr\/en\/wp-json\/wp\/v2\/posts\/27006","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/weblab.gr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/weblab.gr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/weblab.gr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/weblab.gr\/en\/wp-json\/wp\/v2\/comments?post=27006"}],"version-history":[{"count":2,"href":"https:\/\/weblab.gr\/en\/wp-json\/wp\/v2\/posts\/27006\/revisions"}],"predecessor-version":[{"id":27064,"href":"https:\/\/weblab.gr\/en\/wp-json\/wp\/v2\/posts\/27006\/revisions\/27064"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/weblab.gr\/en\/wp-json\/wp\/v2\/media\/27043"}],"wp:attachment":[{"href":"https:\/\/weblab.gr\/en\/wp-json\/wp\/v2\/media?parent=27006"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/weblab.gr\/en\/wp-json\/wp\/v2\/categories?post=27006"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/weblab.gr\/en\/wp-json\/wp\/v2\/tags?post=27006"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}