Votre site Shopify ou WordPress a-t-il été piraté ? Voici la marche à suivre.

Introduction: The Digital Equivalent of Waking Up to a Broken Window

Imagine waking up, grabbing your morning coffee, opening your laptop… and discovering your website has turned into a casino, a sketchy pharmacy, or—worse—a blank white screen of existential dread.

Congratulations.
Your website may have been hacked.

Si vous gérez un Shopify ou WordPress site, this moment feels personal. Like someone broke into your store, rearranged the shelves, spray-painted the walls, and left you with a mess and zero explanation.

The good news?
This is fixable.

The better news?
You’re not alone—and you’re definitely not cursed.

In this guide, we’ll walk through what to do when your Shopify or WordPress site gets hacked, how to clean it up without losing your sanity, and how to prevent it from happening again—with humor, clarity, and zero tech panic.

Step 1: Take a Deep Breath (Seriously)

Before you start changing passwords like a maniac or blaming Mercury in retrograde, pause.

A hacked site is stressful—but it’s not the end of your business.

Most hacks are:

• Automated
• Opportunistic
• Not personal
• Very common

Hackers aren’t sitting in a dark room targeting you. They’re running scripts that scan the internet for weak doors. Your site just happened to leave one unlocked.

So breathe. Then act—calmly.

Step 2: Confirm the Hack (Don’t Guess)

Not every weird behavior equals a hack.

Here’s how you know it’s real:

• Google flags your site as “dangerous”
• Customers report strange redirects
• You see unknown admin users
• Pages you didn’t create suddenly exist
• Your site loads painfully slow—or not at all
• Spam links appear in search results

If you’re seeing any of these, congratulations again—you’ve got a confirmed case of digital food poisoning.

Step 3: Put Up the “Closed for Cleaning” Sign

If your site is actively compromised, limit access immediately.

Pour WordPress:

• Enable maintenance mode
• Temporarily block traffic if necessary
• Disable logins if suspicious activity continues

Pour Shopify:

• Shopify is more secure by default (thank you, Shopify gods), but:
  • Revoke suspicious app permissions
  • Lock staff accounts
  • Contact Shopify Support if malware is detected

This step prevents the hacker from continuing to cause damage while you clean house.

Step 4: Change Passwords (All of Them. Yes, All.)

This is not the time to reuse “Password123”.

Change passwords for:

• Website admin accounts
• Hosting account
• FTP / SFTP
• Database
• Email accounts connected to your site
• Shopify staff accounts
• Third-party services

Use:

• Unique passwords
• Password managers
• Two-factor authentication wherever possible

If a hacker got in once, assume they wrote down the door code.

Step 5: Identify the Entry Point (The “How Did This Happen?” Phase)

This is where things get interesting—and educational.

Common entry points include:

• Outdated plugins or themes
• Poorly coded third-party plugins
• Weak admin passwords
• Unsecured hosting environments
• Old unused user accounts
• Pirated themes (yes, really—don’t do this)

Pour WordPress sites, 90% of hacks trace back to plugins or themes that weren’t updated.

Pour Shopify sites, breaches often involve:

• Malicious apps
• Compromised staff accounts
• External scripts added without review

Understanding how the hack happened helps you make sure it never happens again.

Step 6: Clean the Infection (This Is Not a Surface Wipe)

Now comes the actual cleanup.

Pour WordPress:

• Scan files for malware
• Remove injected code
• Delete suspicious files
• Restore clean core WordPress files
• Reinstall themes and plugins from trusted sources
• Check wp-config.php, .htaccess, and database tables

Pour Shopify:

• Remove suspicious apps
• Review theme code for injected scripts
• Reset theme files if needed
• Check checkout and tracking scripts
• Audit permissions thoroughly

⚠️ Important note:
Restoring from a backup without identifying the vulnerability is like putting dirty dishes back in the cabinet.

You’ll just get hacked again.

Step 7: Check Google, Ads, and SEO Damage

Hackers don’t just want access—they want visibility.

After cleanup:

• Check Google Search Console
• Remove spam URLs
• Request a malware review
• Fix SEO damage caused by injected pages
• Check ad accounts (Google Ads, Meta, etc.)

If Google flagged your site, your traffic may have dropped overnight. Don’t worry—once the site is clean and reviewed, rankings often recover faster than expected.

Step 8: Lock the Doors (Prevent the Next Attack)

Now that the crisis is under control, it’s time to upgrade your defenses.

Smart prevention includes:

• Keeping everything updated
• Removing unused plugins and apps
• Limiting admin access
• Using reputable hosting
• Enabling firewalls and security monitoring
• Setting up automated backups
• Monitoring uptime and file changes

Security isn’t a one-time fix.
It’s a habit.

Shopify vs WordPress: Who Handles Hacks Better?

Let’s be honest.

Shopify is like a high-rise with security guards and cameras.
WordPress is more like owning a house—you get freedom, but you lock your own doors.

Shopify pros

• Platform-level security
• Fewer direct server risks
• Faster recovery in many cases

WordPress pros

• Total control
• Advanced customization
• Strong security if managed properly

Neither platform is “unsafe.”
But unmanaged freedom always carries responsibility.

Step 9: Learn the Real Lesson (It’s Not About Fear)

A hacked site is annoying—but it’s also informative.

It teaches you:

• Where your setup was weak
• What you ignored too long
• Why “set it and forget it” doesn’t work online

The strongest brands don’t avoid problems—they recover faster and smarter.

Final Thoughts: From Crisis to Confidence

If your Shopify or WordPress site gets hacked, it’s not a failure—it’s a wake-up call.

Handled correctly, it becomes:

• A security upgrade
• A design cleanup
• A performance improvement
• A chance to rebuild better

And if all of this sounds overwhelming, that’s okay.

How AIRSANG Helps (Yes, This Is What We Do)

Au AIRSANG, we work with cross-border brands, independent stores, and growing businesses every day—many of them coming to us after a site crisis.

We specialize in:

• Shopify & WordPress conception de sites web
• Secure, clean, conversion-focused layouts
• Cross-border eCommerce experiences
• Performance optimization
• Long-term site stability (not just “launch and disappear” builds)

We don’t just make sites look good—we make sure they’re built to last, scale globally, and stay secure.

If you’re rebuilding after a hack—or want to prevent one before it happens—this is exactly the kind of work we do.