Your WordPress site is showing pop-ups you didn't add, redirecting to strange pages, or your host has suspended it for 'malicious activity'. Take a breath. Hundreds of thousands of WordPress sites get hacked every year, and almost all of them can be put right. What matters is how you respond in the first hours — that decides whether you lose the site, the ranking, or customer data.
Check these first, yourself
Change every password and key you can reach now: hosting — The service that runs your site on a server; the plan you pick decides your speed ceiling and your crash risk., admin users, FTP — File Transfer Protocol — the old way of moving files to a server; left open and unencrypted, attackers love it., payment accounts.
Do NOT wipe and reinstall WordPress yet. You'll lose the evidence of how they got in, and you may destroy the data you need.
Log into your host and look for the last-modified dates on your theme and upload folders. Recently modified files are the fingerprints.
Enable two-factor — A second proof of identity (a code from your phone) on top of the password, so a stolen password isn't enough. on your admin account and every email account connected to the site.
Should you fix it yourself or call a rescue?
Still have questions?
Should I pay the ransom they ask on the hack screen?
Almost never. Extortion screens on WP sites are usually automated malware looking for a quick payout — they rarely restore anything, and paying tells the attacker you're worth revisiting.
Can I just restore an old backup?
Only if the backup is clean — and the backdoor can live in files you restored. Once the site is restored, the hackers can stroll back in through the same door. The infection has to be removed at the source.