Incident Response After a WordPress Hack: A Recovery Runbook

Incident Response After a WordPress Hack: A Recovery Runbook

If your site is hacked, enable maintenance mode immediately, scan with Wordfence or MalCare, restore from a pre-hack clean backup, close the entry point (an outdated plugin or weak password), reset all credentials, and resubmit to Google Search Console to clear the blacklist. Work the steps in that order.

A hacked WordPress site is a stressful, time-sensitive event, but panic and ad-hoc fixes usually make things worse. The teams that recover fastest treat it as an incident: they follow a repeatable runbook that moves from detection to containment, eradication, recovery, and hardening, then closes with a short post-incident review. This guide turns that process into concrete steps you can run today, whether you manage one business site or a portfolio of WordPress installations.

Unlike a quick tool walkthrough, the approach below is built around incident response: contain the damage first so the attacker can’t dig in deeper, then clean and restore in a controlled order. If you would rather hand this off, our WordPress support team can run the recovery for you, but the runbook works on its own.

Signs your WordPress site has been hacked

Before you start a cleanup, confirm you are actually dealing with a compromise and not a plugin conflict or a caching glitch. Common signs a WordPress site has been hacked include:

• Unexpected redirects: visitors land on a spam or pharma page instead of your content; a malicious redirect is one of the most common symptoms.
• Browser or Google warnings: “This site may be hacked” in search results, or a red interstitial warning that the site is serving malware.
• Unknown admin accounts: a new admin account you did not create appears under Users in the WordPress dashboard.
• Modified core files: your security plugin flags changed WordPress core files, or you find strange PHP in wp-config.php or the uploads folder.
• Spam content and pop-ups: injected spam links, defaced pages, or pop-ups you never added.
• Performance and traffic anomalies: sudden slowdowns, a spike in outbound email, or a drop in traffic after Google flags the site.

If you suspect your WordPress site is compromised but you are not certain it is malware, rule out the ordinary causes first with our WordPress troubleshooting guide. A genuine hack will usually show more than one of the signals above.

Why WordPress sites get hacked (common attack types)

Understanding why sites get hacked tells you where to look during cleanup and what to harden afterward. WordPress itself is secure; almost every compromise traces back to one of these entry points:

• Outdated plugins and themes: an un-updated plugin with a known vulnerability is the single most common way attackers get in. Nulled or abandoned plugins are especially risky.
• Weak or reused passwords: brute-force and credential-stuffing attacks target weak admin passwords and exposed login pages.
• Outdated WordPress core: running an old version of WordPress leaves known holes open.
• Insecure hosting or shared servers: a neighbour site on a poorly isolated host can spread an infection across multiple WordPress accounts.
• Stolen credentials: malware on a local machine or a phished password hands an attacker a valid login.

Knowing the likely cause helps you close the entry point in Step 5 rather than just cleaning symptoms, otherwise the site gets re-infected within days.

The WordPress hack recovery process, step by step

Work these steps in order. Skipping ahead: for example, restoring a backup before you know how the attacker got in, is the most common reason a “cleaned” site gets hacked again. This is the core of WordPress hacked recovery.

Step 1: Contain: take the site offline with maintenance mode

The first move is containment. Enable maintenance mode (or put the site behind a “coming soon” page) so visitors are not served malware and Google does not crawl the infected pages while you work. If you can, take a forensic snapshot of the current, compromised state before you change anything, you may need it to understand the attack. Then disable public access at the host or firewall level so the hacker cannot watch you clean and re-infect in real time.

Step 2: Assess: scan with Wordfence or MalCare

Run a full malware scan to map the damage before you delete anything. Install a reputable security plugin such as Wordfence or MalCare and run a complete scan of core files, plugins, themes, the uploads directory, and the WordPress database. A good malware scan will list infected files, injected code, and any backdoors so you know the full scope of the compromise rather than guessing. Note every flagged file: this list drives the eradication step.

Step 3: Eradicate: remove malware and clean core files

Now remove the malware. The safest way to clean WordPress core is to delete the existing core files and reinstall a fresh copy of the same WordPress version from the official WordPress repository, preserving only wp-config.php and the wp-content folder. Then:

• Delete unknown plugins and themes outright, and reinstall the legitimate ones you need from the WordPress repository, never trust the compromised copies.
• Inspect the uploads folder for stray PHP files; the media library should never contain executable code.
• Clean the WordPress database of injected spam, malicious admin accounts, and rogue scheduled tasks.
• Search for backdoors: attackers leave hidden files so they can return even after the obvious malware is gone.

If the infection is deep or you are not comfortable editing core files, a professional WordPress malware removal service can complete this stage safely. Removing malware from WordPress is detailed, careful work, one missed backdoor undoes the whole cleanup.

Step 4: Recover: restore from a pre-hack clean backup

If you have a backup from before the hack, restoring it is often faster and more reliable than hand-cleaning every infected file. Restore the most recent clean backup (one taken before the compromise date) then immediately apply Steps 5 and 6 so you do not restore the same vulnerability. If your backups are too old, or you are not sure when the compromise began, clean the live files instead and rebuild from there. Either way, a tested recovery point is what gets your site back online quickly; if you do not have one yet, set up our recommended WordPress backup strategy the moment recovery is complete.

Step 5: Reset credentials and close the entry point

Cleaning the site is pointless if the attacker still has a way in. Close the entry point you identified earlier (usually an outdated plugin or a weak password) and then reset every credential:

• Force a password reset for all users; delete any admin account you do not recognise.
• Change your hosting, database, FTP/SFTP, and WordPress admin password to strong, unique values.
• Rotate the WordPress security keys (salts) in wp-config.php so existing sessions are invalidated.
• Update WordPress core, plus every plugin and theme, to the latest version to patch the original hole.

This is also the moment to remove abandoned plugins entirely, fewer plugins mean a smaller attack surface.

Step 6: Harden: firewall, updates, and 2FA

Hardening turns a one-time cleanup into lasting website security. At minimum, put a firewall in front of the login page, keep a security plugin running for ongoing malware scanning, enforce two-factor authentication on every admin account, and commit to a real update cadence so plugins never fall behind again. For the full checklist, work through our WordPress security checklist for small businesses and add the HTTP security headers for WordPress that block many injection and clickjacking attacks at the browser. Good WordPress hardening is what keeps your site secure after recovery.

Step 7: Clear blacklists and resubmit to Google Search Console

Once the site is clean and hardened, ask the gatekeepers to re-check it. In Google Search Console, request a review under Security Issues so Google can confirm the site no longer serves malware and lift any “this site may be hacked” warning. Do the same with any browser blacklist or your security plugin’s reputation service. Clearing these flags restores your search visibility and removes the warnings scaring visitors away.

How long does recovery take?

A straightforward case (a single infected plugin, a recent clean backup, and a small site) can be resolved in a few hours. A deeper compromise with multiple backdoors, no usable backup, or a large multi-site install can take a day or more of careful cleanup and verification. The biggest time sink is confirming the site is genuinely clean: a complete recovery means scanning again after the restore, watching logs for re-infection, and verifying every admin account before you take the site back online.

When to hire a professional WordPress recovery service

Handle it yourself when the infection is shallow, you have a clean backup, and you are comfortable editing core files. Bring in a professional WordPress recovery service when the compromise keeps coming back, when customer data or payments are involved, when you cannot find the entry point, or when downtime is costing real money. Experienced teams clean a hacked WordPress site faster and verify the cleanup so you are not back here in a week. Our WordPress support service handles malware removal, recovery, and hardening end to end.

How to prevent your WordPress site from being hacked again

Recovery is only half the job; preventing the next incident is the other half. To keep your site secure going forward:

• Update WordPress core, plugins, and themes promptly, most hacks exploit known, already-patched holes.
• Run automated daily backups stored off-server, and test that you can actually restore them.
• Enforce strong, unique passwords and two-factor authentication on every account.
• Keep a firewall and malware scanner active so a new compromise is caught early.
• Remove plugins and themes you no longer use to shrink the attack surface.
• Schedule a recurring security review so nothing drifts out of date.

Treat these as standing maintenance, not a one-off. A site that is patched, backed up, and monitored is a far harder target, and if it is ever hit again, this same runbook gets you back online fast.

Close the incident: the post-incident review

Professional incident response does not end when the site is back online, it ends with a short review so the same compromise cannot happen twice. Once recovery is verified, spend thirty minutes documenting what happened and what you changed. A useful post-incident review captures:

• The entry point: exactly how the attacker got in (which outdated plugin, which weak password, which exposed file), so you can confirm it is now closed.
• The timeline: when the compromise likely began, how it was detected, and how long the site was serving malicious content. This tells you whether your backups predate the infection.
• What was touched: which core files, plugins, and database tables held malicious code, and whether any customer data was exposed. If personal data was at risk, you may have a disclosure obligation.
• The fixes applied (credentials rotated, plugins removed, hardening added) so the next person who manages the site has a record.

Feed those lessons straight into a recurring schedule: a monthly malware scan, a quarterly security review, and a backup-restore test. The whole point of treating a hack as an incident (rather than a one-off fire drill) is that each event leaves the site measurably harder to compromise than it was before. Keep this runbook somewhere your team can find it, because the calm, ordered response it describes is exactly what you will want the next time something looks wrong.

Frequently asked questions

How do I recover a hacked WordPress website?

Contain the site with maintenance mode, scan for malware with Wordfence or MalCare, remove the malware or restore a pre-hack clean backup, reset all credentials and close the entry point, harden the site with a firewall and updates, then resubmit to Google Search Console to clear any blacklist. Working the steps in that order prevents re-infection.

Can a hacked WordPress website be recovered without losing content?

Usually, yes. If you have a recent clean backup you can restore it with content intact, or you can clean the live files while preserving the wp-content folder and database. The risk to content rises the longer a compromise goes undetected, which is why early detection and reliable backups matter.

What are the signs that a WordPress website has been hacked?

Watch for unexpected redirects, “this site may be hacked” warnings in Google, unknown admin accounts, modified core files, injected spam content or pop-ups, and unexplained traffic or performance changes. More than one signal at once strongly suggests a genuine compromise rather than a plugin conflict.

What are the immediate steps to take when a WordPress site is hacked?

Enable maintenance mode to take the site offline, change your hosting and WordPress admin password, and run a full malware scan before deleting anything. Containing the site and assessing the damage first stops the attacker from spreading while you plan the cleanup.

How long does it take to recover a hacked WordPress website?

A simple case with a clean backup can be fixed in a few hours; a deep compromise with backdoors or no backup can take a day or more. Most of the time goes into verifying the site is genuinely clean before bringing it back online.

When should I hire a professional for WordPress hacked recovery?

Hire help when the site keeps getting re-infected, when customer data or payments are at risk, when you cannot find how the hacker got in, or when downtime is costing money. Professionals clean and verify the recovery so the problem does not return.

Why do WordPress sites get hacked?

Almost always through outdated plugins or themes, weak or reused passwords, outdated WordPress core, or insecure hosting. WordPress itself is secure: the weak points are usually unpatched extensions and credentials, which is why hardening focuses there.

How can I prevent my WordPress website from being hacked again?

Keep everything updated, run tested off-server backups, enforce strong passwords and two-factor authentication, run a firewall and malware scanner, remove unused plugins, and schedule a recurring security review. Consistent maintenance is what keeps your site secure long term.

Recover, then harden

A hacked WordPress site feels like an emergency, but a calm, ordered incident response gets you back online safely: contain, assess, eradicate, recover, reset, harden, and clear the blacklist. Run the steps in sequence, close the entry point that let the hacker in, and put the prevention habits in place so the next attempt fails. If you would rather have specialists run the recovery and hardening for you, our WordPress support team is ready to help.

Authoritative references: WordPress.org: FAQ: My site was hacked · OWASP Top 10 web application security risks · Wordfence, How to clean a hacked WordPress site.