- AEO QUICK ANSWER
WordPress 7.1 Update Guide for UK Businesses
If you run a business website on WordPress, 2026 has been the busiest year for the platform since block editing arrived. WordPress 7.0 shipped in May with AI infrastructure built into core and a redesigned admin. WordPress 7.1 followed in August. The 7.1.1 maintenance release lands this week, and 7.2 is already scheduled for December.
That is four significant updates in one year for a site that most owners would rather not think about at all.
This guide explains what actually changed, what is likely to break on a typical UK business site, and how to update without losing a morning of trading. It is written for business owners and agency teams, not core contributors, so we will stay away from the developer detail unless it affects a decision you need to make.
This snippet is structured to appear in AI search results including ChatGPT, Perplexity and Google AI Overviews.
- IN THIS ARTICLE
You have probably arrived here because something is wrong. The site redirects to a page selling pills. Google is showing “This site may be hacked” under your listing. A customer emailed to say your site tried to install something. Or you logged in and found an administrator you did not create.
Take a breath. A hacked WordPress site is recoverable, almost always within a day, and usually without losing content. The order you do things in matters more than the speed. This guide gives you that order.
If you would rather hand it to someone now, WPMiracle handles malware rescue for UK businesses and agencies and the contact details are at the end. Otherwise, work through the steps below.
How do you know your WordPress site has been hacked?
A hacked WordPress site is one where an attacker has gained unauthorised access and modified files, the database, or user accounts, usually to serve spam, redirect visitors, steal data or use the server for further attacks. The common signs are:
- Visitors redirected to another site, often only on mobile or only from Google.
- Google Search Console warnings or a “hacked site” or “deceptive site” label in results.
- Pages or links you did not create, frequently for pharmaceuticals, gambling or loans.
- New administrator users.
- The site is suddenly slow or the host has warned about resource usage.
- Your emails are bouncing or landing in spam because the domain is sending junk.
- Wordfence or your host reports modified core files.
- The site is down and the host has suspended it for malware.
One sign is enough. Do not wait for a second.
Hour 0 to 1: contain the damage
The first hour is about stopping things getting worse, not fixing them.
1. Do not delete anything yet. The instinct is to remove the obvious spam page. Resist it. Deleting evidence makes it harder to find how the attacker got in, and the obvious file is rarely the only one.
2. Put the site into maintenance mode or take it offline. If visitors are being redirected or served malware, every minute online is harming them and your reputation. A simple maintenance page at the server level (via .htaccess or the host’s panel) is enough. If you cannot do that, ask the host to suspend public access temporarily.
3. Change every password. WordPress admin accounts, the hosting control panel, FTP or SFTP, the database user, and your email if it shares a password with any of those. Do this from a device you trust.
4. Take a snapshot. Before cleaning, take a full copy of the site as it is now, files and database. Label it “infected, do not restore”. You may need it to trace the entry point.
5. Tell the people who need to know. Your host (they may already know), your agency or maintenance provider, and internally whoever handles customer contact. If customer data may have been exposed, note the time you became aware, because the UK GDPR 72-hour reporting clock starts here.
- Stay visible across Google and AI search. WP Miracle blends SEO and AEO into one strategy.
Hour 1 to 4: find the extent of the compromise
Now you work out what was touched.
Check the users list. Look for administrators you do not recognise, accounts with odd email addresses, or legitimate accounts whose email has been changed. Remove or demote them, but note the details first.
Run a malware scan. Wordfence’s scanner compares your core, theme and plugin files against the originals on WordPress.org and flags anything modified, plus known malware signatures. If Wordfence is not installed, install it now; it can be installed on a compromised site.
Check the file system directly. Via SFTP or the host’s file manager, look for recently modified files, particularly in wp-content/uploads (which should contain no PHP files), the site root, and wp-includes. Files with random names, or PHP files where none should be, are suspects.
Check the database. In wp_options, look at siteurl, home and any option with a suspicious script. In wp_posts, search for iframe, script, base64 or eval. Injected redirects often live here rather than in files.
Check .htaccess and wp-config.php. Redirect hacks frequently add rules to .htaccess that only fire for mobile user agents or search engine referrers, which is why owners often cannot reproduce the problem on their own desktop.
Check scheduled tasks. Malware often reinstalls itself through a cron job. WP Crontrol is a free plugin that lists them.
Write down everything you find. This becomes your clean-up list.
Hour 4 to 12: clean or restore
You now have a decision: clean the site in place, or restore from a backup taken before the infection.
Restore from backup if you have a clean backup from before the earliest modified file date, and the content changes since then are small enough to redo. This is faster and more reliable than manual cleaning.
Clean in place if there is no clean backup, or the backup would lose too much content, or the site is an e-commerce store with orders you cannot afford to lose.
For a restore: restore files and database from the clean backup, then immediately apply steps from the “harden” section below before bringing the site back online. Otherwise the attacker walks back in through the same door.
For a manual clean, in this order:
Replace WordPress core. Download the current version from WordPress.org and overwrite wp-admin and wp-includes entirely. Never overwrite wp-content or wp-config.php.
Reinstall every plugin from a fresh download. Delete the plugin folder first, then reinstall. Do not “update” a compromised plugin; the malicious files may survive.
Reinstall the theme from a fresh copy. If the theme is custom and you have no clean copy, this is the hardest part and you will need to compare files by hand.
Clean wp-content/uploads. Remove every PHP file. There should be none.
Clean the database. Remove injected scripts from posts and options, and any rogue users.
Review wp-config.php line by line and check .htaccess against a default.
Run the malware scan again. Repeat until clean.
Budget three to eight hours for a manual clean of a typical business site. Longer if the theme is custom.
Hour 12 to 24: harden, verify and reopen
A cleaned site with the same weaknesses is a site waiting to be hacked again.
Update everything. Core to the current release (7.1.1 as of this week), every plugin, the theme, and PHP to 8.2 or 8.3. The vulnerability that let the attacker in is very likely in something outdated.
Remove what you do not need. Unused plugins and themes, deleted. Inactive users, removed.
Enforce two-factor authentication for every administrator and editor. Wordfence’s free tier includes it.
Reset the WordPress security keys in wp-config.php using the generator at api.wordpress.org/secret-key/1.1/salt. This invalidates every existing session, including the attacker’s.
Regenerate any API keys stored in the site: payment gateway keys, email service keys, AI connector keys added since WordPress 7.0, anything under Application Passwords.
Disable file editing with DISALLOW_FILE_EDIT in wp-config.php.
Check the site from outside. Use an incognito window on mobile, a different network, and a tool like Sucuri SiteCheck or VirusTotal to confirm the site no longer serves anything malicious.
Reopen and monitor closely for 48 hours. Reinfection within a day means you missed a backdoor or a cron job.
How do you recover Google rankings after a hack?
This is the part most guides skip and most owners worry about most.
If Google flagged the site, open Search Console and check Security Issues. Once the site is clean, use Request a Review from that screen. Reviews for hacked-site flags typically clear within a few days if the clean-up is complete. Reviews for malware or phishing flags can take longer and are stricter.
Then check Coverage or Pages for indexed spam URLs. Hacked sites often have hundreds of junk pages indexed. Once they return 404 or 410, request removal of the worst through the Removals tool and let the rest drop out naturally over a few weeks.
Rankings usually recover within two to six weeks of the flag clearing, provided the site was cleaned quickly. Sites that stayed infected for months take longer, because Google has had time to associate the domain with spam.
If your email domain was used to send spam, check your domain’s reputation with Google Postmaster Tools and make sure SPF, DKIM and DMARC records are correct.
What should you tell customers?
If the site was only defaced or redirecting, and no personal data was accessible, a short notice on the site and social channels (“We experienced a security issue on [date]; it has been resolved and no customer data was affected”) is sufficient and builds trust.
If personal data may have been accessed, whether contact form submissions, customer accounts or order details, you have obligations under UK GDPR. Assess the risk to individuals. If there is a risk, report to the ICO within 72 hours of becoming aware, and inform affected people without undue delay. The ICO’s self-assessment tool helps with the decision, and being honest and prompt is looked on far more favourably than being found out later.
How much does WordPress malware removal cost in the UK?
Professional malware removal for a UK business site typically costs £150 to £500 as a one-off, rising to £800 or more for complex sites, e-commerce stores or sites with custom themes. UK sources put the total cost of a small business site compromise, including downtime and clean-up, at £500 to £1,500.
Some maintenance providers include malware removal in their monthly plans, which is worth checking before you need it. WPMiracle includes clean-up in every care plan. For sites not on a plan, we quote malware rescue as a fixed fee after a short assessment, so you know the cost before work starts.
How do you stop it happening again?
Everything in the hardening section, plus three habits.
Update weekly, with a person checking what changed. Most hacks exploit a vulnerability that had a patch available.
Back up daily to somewhere off the hosting account, keep 30 days, and test a restore twice a year. The difference between a bad day and a bad month is a clean backup.
Monitor. A malware scan on a schedule and uptime monitoring with alerts to a human. You want to be the first to know, not the last.
If that sounds like a maintenance plan, it is. The cost of one starts at £79 a month. The cost of not having one is described above.
FAQS
1. Can I fix a hacked WordPress site myself?
Yes, if you are comfortable with SFTP, the database and the steps above. Budget most of a day. If the site earns money, the safer option is usually to get professional help and use the day to communicate with customers.
2. Should I just delete the site and start again?
Rarely necessary. Content and design are almost always recoverable. Starting again also does not fix the weakness that let the attacker in, and loses your search rankings.
3. Will my host clean a hacked site?
Some managed hosts include one clean-up. Most shared hosts will suspend the account and expect you to clean it. Check your host’s terms before assuming.
4. How did my WordPress site get hacked?
Most often through an outdated plugin with a known vulnerability, followed by a weak or reused administrator password. Less commonly through the host, a compromised computer with saved credentials, or a nulled theme.
5. How long does WordPress malware removal take?
Restoring from a clean backup: one to three hours including hardening. Manual clean of a typical site: three to eight hours. Complex sites with custom code: a day or more.
