Triage the Incident
Record what was observed, when it began, recent changes and who has access. Capture suspicious URLs, search results, user accounts, redirects, warnings and host notifications. This provides a baseline for investigation and helps distinguish the initial compromise from later changes.
| Indicator | Immediate priority |
|---|---|
| Visitors redirected or served malware | Contain public harm and preserve a copy for investigation. |
| Unknown administrator accounts | Restrict access, review logs and rotate privileged credentials. |
| Search results show injected pages | Find affected files/database content and preserve the URL list for later cleanup. |
| Host suspended the site | Request their indicators and required remediation evidence before attempting restoration. |
| Problem returns after file deletion | Look for persistence, stolen credentials, vulnerable extensions and compromised adjacent accounts. |
Recovery Sequence
- Document indicators and times. Preserve screenshots, URLs, alerts, log windows and recent administrative changes.
- Create a protected incident copy. Back up files and database even when infected; it may be needed for investigation or recovery.
- Contain the impact. Restrict access or place the site in a controlled state without destroying the evidence.
- Inventory every access route. Review WordPress users, hosting, SFTP/SSH, database, registrar, DNS, CDN and email accounts.
- Compare against trusted software. Replace WordPress core and legitimate extensions from known sources; inspect uploads, configuration, scheduled tasks and database content.
- Remove persistence and the entry route. Cleaning visible files is incomplete if a stolen credential or vulnerable component remains.
- Rotate secrets in the right order. Change hosting and privileged access, WordPress salts and database credentials as appropriate, then invalidate old sessions.
- Patch, harden and monitor. Update software, reduce privileges, protect login/admin surfaces, verify backups and watch files, logs and search results.
Hardening After Clean-Up
Use least privilege, strong unique credentials and multi-factor authentication wherever supported. Remove abandoned plugins and themes, keep supported software updated, restrict file editing and administrative access, protect backups from the same compromise, and retain logs long enough to spot recurrence.
A recovery plan may need both. Deletion without a verified backup and scope can remove business data and erase useful evidence.
What Usually Fails
- Deleting one injected file without finding how it returns.
- Restoring an old backup and leaving the vulnerable plugin or stolen password in place.
- Rotating only the WordPress administrator password.
- Installing several security plugins during an active incident without understanding their changes.
- Assuming a scanner's green result proves every layer is clean.
- Reopening the site without monitoring or external verification.
Sources and Further Reading
Platform requirements and recommended practices change. These primary sources were checked when this guide was reviewed.
- WordPress: My site was hacked — primary documentation consulted for this guide.
- WordPress hardening guide — primary documentation consulted for this guide.