A hacked WordPress website calls for speed, but not panic. Randomly deleting files or immediately restoring an old backup can destroy evidence, leave a backdoor behind, or create new email and SEO problems. A reliable recovery plan first contains the incident, preserves evidence, and then rebuilds trust in a controlled way.

1. Contain the incident without destroying evidence

Place the website in maintenance mode or restrict access at server level when necessary. Do not remove anything until the files, database, logs and current configuration have been preserved. A snapshot of the compromised state helps reconstruct the attack and prevents decisions based only on assumptions.

Check whether the site is sending spam, redirecting visitors, running unknown scheduled jobs or containing unfamiliar administrators. Review DNS records, email forwarders and API keys too. A compromise does not always stop at WordPress.

2. Create a forensic backup

Save all files and the database with a clear timestamp. Store this copy outside the hosting account and do not treat it as a production backup. Record when the incident was discovered, which warning appeared and every action performed afterwards. This makes the recovery process auditable.

3. Eliminate stolen access

Change credentials for WordPress administrators, hosting, SFTP/SSH, databases and linked email accounts. Revoke unused sessions, application passwords and API tokens. Enable multi-factor authentication where possible. Perform these steps from a clean device, because malware on a workstation can steal the replacement credentials again.

4. Establish the full scope

Compare WordPress core, plugins and themes with clean packages from their official sources. Do not search only for recently modified PHP files. Attackers may hide code in uploads, database options, user profiles, must-use plugins, scheduled tasks and apparently normal files. Check other websites within the same account as well.

5. Restore cleanly or rebuild?

If a demonstrably clean backup is available, restore it in an isolated environment and update everything before putting it online. Without a trustworthy backup, rebuilding is often safer: install WordPress from scratch, reinstall trusted plugins and themes, and migrate only verified content and uploads. Removing one suspicious file does not prove the website is clean.

6. Close the original entry point

Investigate outdated plugins, weak or leaked credentials, unsafe uploads and vulnerable custom code. Remove unused software. Correct file permissions, minimise administrator accounts, enable appropriate security updates, and protect login and form endpoints against automated abuse.

At Gigatech, account isolation, malware controls and network security provide additional layers. They do not replace secure maintenance, but they help prevent one problem from affecting other customers or sites. See our practical WordPress security checklist.

7. Review reputation, SEO and email

Inspect Search Console for unknown pages, manual actions and unusual search queries. Check the sitemap and all indexable URLs. If the account sent spam, investigate mail queues, logs and domain reputation. After recovery, test forms, transactional email, caching and scheduled tasks.

8. Monitor after relaunch

A successful cleanup must be followed by monitoring. For several weeks, watch file changes, failed logins, outgoing email volume, new users, unfamiliar processes and recurring malware alerts. Then create a new clean backup and perform an actual restore test.

Recovery checklist

• Isolate the website and preserve its current state.
• Store a forensic backup outside the account.
• Replace relevant passwords, sessions and tokens.
• Inspect files, database, users, cron jobs and neighbouring sites.
• Restore a clean backup or rebuild in a controlled environment.
• Close the root cause and remove unused software.
• Review SEO, email, forms and logs.
• Create a clean backup and activate monitoring.

Frequently asked questions

Can I immediately restore a backup?

Only if it is reasonably certain to predate the infection. Update and inspect the restored copy offline before directing traffic back to it.

Is a security plugin sufficient?

No. Effective protection combines maintenance, secure access, server controls, backups, monitoring and trustworthy software. A plugin is one layer.

Do I need to notify customers?

That depends on the data involved and your legal obligations. If personal data may have been exposed, determine the scope carefully and obtain appropriate privacy or legal advice.

Need help? Open a ticket through the Gigatech support portal. Include when the issue started and avoid unnecessary changes before the initial analysis.