Contain the damage
Put the site into maintenance mode if needed, change every password, and remove unknown admin users.
Let your hosting provider know so they can help and check other sites on the account.
A useful starting point
Before deleting anything, take a full backup of the infected site so evidence and content are not lost.
Clean thoroughly
Remove infected files, unknown plugins, and injected code from the database. Replace core files with fresh copies.
Partial cleanups often leave backdoors that allow the hacker straight back in.
Ask search engines to review
Once the site is clean, request a review in Google Search Console to remove warnings.
Monitor closely for several weeks to confirm the infection does not return.
Your practical checklist
- Change all passwords immediately.
- Remove unknown users and plugins.
- Replace core files with clean copies.
- Scan the database for injected code.
- Request a review in Search Console.
