Do Not Start By Deleting Evidence
The first hour matters. Preserve the symptom, timestamps, affected URLs, suspicious users, changed files, and host notices before cleanup. Without that evidence, the same entry point may stay open.
Problem
What To Do After a WordPress Site Is Hacked
Respond to a suspected WordPress hack by preserving evidence, containing access, checking administrators and files, reviewing backups, and planning safe recovery.
Problem, cause, fix, verify
Problem
A hacked WordPress site needs careful containment and evidence review; deleting files, restoring blindly, or changing random settings can hide the cause and extend the incident.
Audience
WordPress site owners, agencies, administrators, and support teams handling a suspected compromise.
First check
The first hour matters. Preserve the symptom, timestamps, affected URLs, suspicious users, changed files, and host notices before cleanup. Without that evidence, the same entry point may stay open.
Verify
WPlura Security Center can help organize WordPress-side security review notes, while Backup & Restore Manager and Diagnostics can support recovery evidence and post-incident checks.
Editorial trust
- Publisher
- WPlura Editorial Team
- Published
- Updated
- Content type
- Problems
On this page
Symptom
A hacked WordPress site needs careful containment and evidence review; deleting files, restoring blindly, or changing random settings can hide the cause and extend the incident.
For: WordPress site owners, agencies, administrators, and support teams handling a suspected compromise.
Diagnosis
What to check before changing the site
Contain The Obvious Access
Unknown administrators, reused passwords, exposed FTP/SFTP credentials, and compromised hosting panels can keep the incident alive. Containment should be coordinated, not improvised one account at a time.
Review Before Restore
A backup helps only if it predates the compromise and can be restored safely. Restoring too early can erase evidence or bring back infected files.
Recovery Proof
Recovery is not done when the homepage looks normal. Verify users, files, wp-admin, forms, checkout if active, public search signals, logs, and any host or search warnings.
WPlura Fit
WPlura Security Center can help organize WordPress-side security review notes, while Backup & Restore Manager and Diagnostics can support recovery evidence and post-incident checks.
WordPress SecuritySeverity: CriticalLast reviewed: 2026-09-16
Diagnosis
Symptoms, causes, checks, and fixes
Symptoms
- The site redirects unexpectedly, shows injected content, sends spam, exposes strange files, or has unknown administrator accounts.
- Search results, browser warnings, customers, or the host report suspicious behavior.
- The team is tempted to restore a backup immediately without knowing when the compromise began.
Most Common Causes
- WordPress risk can involve weak credentials, outdated plugins or themes, writable files, exposed backups, compromised hosting access, custom code, or reused passwords.
- A restore can reintroduce malware if the backup already contains the compromise.
- Evidence disappears quickly when teams delete files, clear logs, rotate accounts, or reinstall plugins without recording what changed.
How To Confirm The Cause
- Record the first-seen time, affected URLs, screenshots, unknown files, administrator accounts, plugin/theme versions, host alerts, and recent changes.
- Check administrator users, file changes, uploads, wp-config.php, plugins, themes, debug logs, public archive files, and Site Health warnings.
- Identify the cleanest known backup point without restoring over live evidence too early.
Fixes
- Contain access first: change known-compromised credentials, remove unknown administrators, and coordinate with hosting when server-level access may be involved.
- Preserve evidence before cleanup so the entry point can be fixed.
- Restore only from a reviewed backup and then update, harden, monitor, and verify the recovered site.
How To Verify The Fix
- Confirm no unknown administrators, suspicious upload executables, exposed backup files, or unexpected modified application files remain.
- Retest public pages, wp-admin, forms, checkout if active, search visibility, and key integrations after recovery.
- Monitor logs, file changes, users, and search/security warnings during the next traffic window.
When To Contact Support
Escalate immediately when customer data, payment data, server access, legal notification, malware cleanup, host suspension, or production restore decisions are involved.
References