What to Do When Your WordPress Website Is Compromised: Hide the Broken Site in Maintenance Mode While You Clean It Up

Put the compromised WordPress site into maintenance mode first, then clean it behind closed doors. Do not let visitors keep seeing malware warnings, broken layouts, spam redirects, or strange popups while you investigate. WordPress sites are frequent targets; Patchstack reported 5,948 new WordPress ecosystem vulnerabilities in 2023 [source: Patchstack]. Hiding the public site is not the fix, but it buys you time and protects trust.

TLDR: If your WordPress site is hacked or visibly broken, enable maintenance mode, show a short notice, and block public access while you clean the infection. For example, if your site gets 1,500 visits a day and even 5% land on a malware warning, that is 75 people who may not come back. Use the Maintenance plugin to show a controlled message while admins keep working. Then remove malware, patch the site, change passwords, and only reopen when tests are clean.

Why maintenance mode matters after a compromise

A hacked site is not just ugly. It can steal logins, send visitors to scam pages, leak customer data, or get your domain flagged by browsers and email filters. If you leave it online, the damage keeps spreading.

Maintenance mode creates a safer public front. Visitors see a clear message instead of a broken site. Search engines and users get a temporary signal, not a mess of infected pages. Your team can still work in the dashboard.

The catch is that maintenance mode can feel like a cosmetic fix. It is not. It is a containment step. You still need to remove the infection and close the door the attacker used.

Step 1: Do not panic, but act fast

Before clicking around wildly, take a breath. Random changes can destroy evidence or make recovery harder. Start with these actions:

• Take a full backup of files and database, even if infected.
• Contact your host and ask for server logs, malware scans, and recent access records.
• Record what you see: redirects, strange admin users, alerts, modified files, or spam pages.
• Do not delete everything at once. You may need timestamps and file paths.

If you can still access wp-admin safely, move to maintenance mode right away. If you cannot log in, ask your hosting provider to restrict public access while you regain control.

Step 2: Enable the Maintenance plugin

Install or open the Maintenance plugin on WordPress.org. You can use the free version for a simple maintenance screen. If you use the PRO version, check settings and licensing through wpmaintenancemode.com.

In most cases, the basic flow is simple:

1. Log in to your WordPress admin area.
2. Go to Plugins and install Maintenance, if it is not already active.
3. Open the plugin settings.
4. Switch maintenance mode to On.
5. Add a short message for visitors.
6. Save changes and test the site in a private browser window.

Use plain wording. Do not say “we were hacked” unless your legal or security team tells you to. A calm message works best:

“We are performing emergency maintenance and will be back shortly. Thank you for your patience.”

Step 3: Make sure admins can still work

A good maintenance page should block visitors, not your cleanup team. Confirm that administrators can still reach wp-admin. If needed, whitelist trusted roles or use PRO controls to allow certain users through.

Honestly, it feels like the worst time to fight plugin settings is during a security incident. Still, spend the extra minute testing access. Open one browser where you are logged in, and another private window where you are not. The private window should show the maintenance page. The logged-in admin should see the real site.

Step 4: Clean the site behind the maintenance wall

Now do the serious work. Maintenance mode only hides symptoms. Your goal is to remove malicious code and stop reinfection.

• Reset all passwords: WordPress admins, hosting, FTP, database, email, and control panel.
• Remove unknown admin users and check for strange new accounts.
• Update WordPress core, plugins, and themes from trusted sources only.
• Remove unused plugins and themes, especially abandoned ones.
• Scan files for malware, backdoors, and altered PHP files.
• Check wp-config.php and .htaccess for unfamiliar code.
• Review uploads for PHP files or scripts that should not be there.
• Search the database for spam links, injected scripts, and rogue admin options.

Expect to waste time on files that look normal at first. Attackers often hide code inside old theme folders, fake plugin names, or image directories. Slow down here. A rushed cleanup usually means the site gets hit again two days later.

Step 5: Check SEO, forms, and payments

After malware removal, test the parts that affect money and trust. Check contact forms, checkout pages, analytics scripts, ad pixels, and login pages. Look for new JavaScript, strange iframes, or changed payment settings.

If browsers showed a warning, request a review after the site is clean. If spam pages were indexed, remove them and submit fresh sitemaps. Keep the maintenance screen up until those checks pass.

Step 6: Reopen carefully

Before turning maintenance mode off, run one final pass:

• Visit the site as a logged-out user.
• Test on mobile and desktop.
• Confirm no redirects appear.
• Check key pages, forms, and checkout.
• Review server logs for fresh suspicious requests.
• Keep backups of the cleaned version.

When everything looks clean, disable maintenance mode in the Maintenance plugin. Watch the site closely for the next 48 hours. If new files appear or redirects return, the attacker still has access somewhere.

What to do after the site is live again

Set up regular backups, remove unused accounts, and keep plugins current. Use strong passwords and two-factor login where possible. Limit admin access to people who truly need it.

The main rule is simple: do not show a broken or infected WordPress site to the public while you fix it. Put it in maintenance mode, clean it with care, then reopen only when you can stand behind it.