A hacked website is an incident, not simply a maintenance ticket. The response should protect evidence, reduce ongoing harm, restore trustworthy operations, and close the path that allowed the compromise.
Phase 1: Contain and preserve
Containment may include restricting public access, disabling a vulnerable feature, stopping outbound abuse, isolating the affected site, or placing the website behind a controlled maintenance response. The right action balances security, evidence preservation, and business continuity.
Phase 2: Determine scope
Scope includes the WordPress installation, database, hosting account, adjacent websites, server-level configuration, users, credentials, logs, backups, CDN or proxy rules, and external warnings. A site that appears visually normal can still be compromised.
Phase 3: Restore trusted components
WordPress core and publicly distributed plugins or themes should be replaced from verified sources when possible. Custom code requires separate review. Content and database records should be retained only when they can be reasonably validated or safely reconstructed.
Phase 4: Rotate access and close the entry point
Recovery commonly involves changing WordPress, hosting, SFTP, SSH, database, email, CDN, DNS, API, and application credentials. Vulnerable or abandoned components should be patched, replaced, or removed rather than left in place.
Phase 5: Controlled return to service
Before reopening, validate core site functions, forms, authentication, redirects, scheduled tasks, outgoing mail, caching, TLS, backups, logging, and external scans. Then continue monitoring because some persistence is designed to remain dormant.
Information that speeds up triage
- The affected domain and hosting provider.
- The exact warning, redirect, file name, or alert received.
- The earliest known date and any recent site changes.
- Whether WordPress, hosting, database, DNS, and backups are still accessible.
- Whether multiple websites share the same account or server.
- Any cleanup steps already attempted.