You may want to log into your site’s PHP database and make sure the site URL and home links are the correct ones.
If your site is going down often, and it’s not because of malware, you might want to look for a reliable web host. Make sure to check your web host dashboard or cPanel, to verify if you’re overusing your hosting resources, as those could be an indicator that you may even need to upgrade your package.
Do an online malware scan?
There are plenty of reputable malware scanners and they are all free, even if they have some advertisements for their malware cleanup services. You can check online scanners like Sucuri SiteCheck, Qutterra Malware Scanner, and Virus Total. These types of scanners can do a brief overview of what’s going on.
Please note that some hacks won’t always be picked up by the free online malware scanners. Some JavaScript malware site redirects are commonly missed, but it's usually because there are always new versions of this hack always popping up.
Ask your web host to do a malware scan.
Your web host can provide you with a malware scan. Sometimes you may have to ask them to scan the site for you, or there’s an area for you to initiate your own malware scan.
Like online malware scans, sometimes the scanner that your web host provides, may not catch every malicious infection known with WordPress.
Do a WordPress malware scan.
Do a deep malware scan using a WordPress plugin. This may require you to disable your plugins or chosen theme briefly, in order to get into WordPress and use a good malware scanning plugin like GOTMLS.
Is WordPress secure?
Yes, at its core, as long as you keep WordPress up-to-date with its latest version, your site is secure. Now, when you put plugins and themes on top of WordPress, most of the popular plugins and themes are secure. However, with how technology evolves, there’s always going to be some code vulnerability. In most cases, in order to keep your site as secure as possible, you merely need to update your plugins and themes.
Sure, performing regular site maintenance, just to update your entire site might seem tedious, but it's an insurance against possible malicious code injections, and the extra effort to clean and secure the site after a hacking.
Lastly, on top of making sure WordPress, your plugins and themes, are all updated, make sure when choosing them, that they are from reputable developers. Don’t download from places that sell nulled themes or plugins, because in some cases, they may contain malicious code, or the end user won’t be able to update them properly in the future.
Cases where your site is just down, and not hacked.
Theme or plugin conflict.
If your site has no malware issues, you may have a simple theme or plugin conflict. You will need to slowly deactivate each plugin until the problem goes away. Usually when the problem or error is gone while doing a conflict check, that means the plugin or theme, mostly decently deactivated, was more than likely the cause. In some cases, you may need to choose an alternative plugin or fix the issue with a code or see if there’s an update that resolves the problem.
Routine server maintenance.
In rare cases, your hosting will be down for maintenance. This doesn’t necessarily mean you’ve been hacked, but that the web host needs to perform some actions on the server to either upgrade hardware or software, in order to keep their end secure. Usually your web host will inform you of any routine server maintenance, and whether to expect any downtime.
How to clean up a hacked WordPress site?
