Slow or Hacked WordPress Site: Fix It or Rebuild?

Fix it if the problem traces to one or two causes, such as a heavy theme, an outdated plugin, or slow hosting, and the site otherwise does its job. Rebuild if you keep paying for cleanups, the site depends on abandoned plugins, or it needs a redesign anyway.

Why WordPress sites get slow

  • Page builders and heavy themes that load large scripts and styles on every page.
  • Too many plugins, each adding database queries, scripts, or both.
  • Unoptimized images: full-size photos scaled down in the browser.
  • Slow shared hosting and no page caching, so every visit rebuilds the page.
  • An outdated PHP version, which can be markedly slower than current releases.

Find the cause

  • Run the slowest pages through Google PageSpeed Insights and read which resources it flags.
  • Check Core Web Vitals in Search Console to see which page groups fail for real visitors.
  • Install Query Monitor temporarily to find slow plugins and database queries, then remove it.

If your site was hacked

  1. Contain it. Put the site into maintenance mode or take it offline if it is redirecting visitors or serving spam.
  2. Restore or clean. Restore a backup from before the compromise, or have the site professionally cleaned.
  3. Change every credential: WordPress admin accounts, hosting, database, SFTP, and any API keys.
  4. Update and prune. Update WordPress core, themes, and plugins, and delete anything unused. Outdated plugins and themes are the most common way in.
  5. Check Google. Look at the Security Issues report in Search Console, and request a review once the site is clean.

Fix it or rebuild?

Fix it when

  • The problem traces to one or two causes, such as one heavy plugin or slow hosting.
  • The site otherwise does what you need and you are happy with the design.
  • Someone will keep it updated from now on.

Rebuild when

  • You have paid for more than one cleanup, or the same problem keeps coming back.
  • The site depends on plugins or a theme that are no longer maintained.
  • It needs a redesign anyway.
  • Hosting, plugin licenses, and maintenance cost more each year than the site is worth to you.

A rebuild as a static site removes the public WordPress login, the database, and the plugins: the parts of WordPress that most attacks target and most slowdowns come from. See our WordPress migration service.

Frequently asked questions

Why is my WordPress site so slow?
Usually a heavy theme or page builder, too many plugins, large images, or slow shared hosting without caching. PageSpeed Insights and the Query Monitor plugin show which one applies to your site.
How do I know if my WordPress site has been hacked?
Common signs are admin users you did not create, visitors redirected to other sites, spam pages appearing in Google results, a "This site may be hacked" warning in search, or your host suspending the account.
Will moving off WordPress stop hacks?
Moving to a static site removes the most common targets: there is no public WordPress login, database, or plugin code for attackers to exploit.

Related