If you are wondering what to do after a WordPress site is hacked, focus first on limiting harm and preserving information that can help uncover what happened. Avoid rushing to delete unfamiliar files or reinstall the site. Those actions may remove clues, and they do not necessarily secure the account or system the attacker used to get in.
Use the steps below as a first-response checklist. If the site supports important business activity or contains customer information, involve your hosting provider and a qualified technical responder early.
Record what you see before making changes
Write down when the problem was noticed and what raised concern. Save screenshots of suspicious pages, browser warnings, unusual redirects, unexpected administrator accounts, or error messages. Note any recent changes to the site or its hosting, if known.
Keep the notes and screenshots somewhere separate from the affected website. Do not post sensitive details publicly. This record can help your host or responder compare what you observed with server and security logs.
Contact the host and limit exposure
Tell the hosting provider that you suspect a compromise and ask them to preserve relevant logs and advise on containment. The provider may be able to restrict access, isolate the affected site, or help identify whether other sites in the same hosting account could be affected.
Whether to take the site offline depends on what visitors are seeing and what the site does. If it is redirecting visitors, displaying harmful content, or exposing sensitive information, reducing public access may be the safer choice. In other cases, a temporary maintenance page or restricted access may limit exposure while the investigation continues. Coordinate with the host or responder before making changes that could erase logs or other useful evidence.
Do not assume that a visible defacement is the whole problem. A site can appear normal while malicious code or unauthorized access remains. If the website accepts payments, provides customer accounts, or handles personal information, ask a qualified technical responder to help assess possible exposure. Bring in appropriate privacy or legal professionals to evaluate any notification obligations.
Preserve a copy and relevant logs
Before cleanup or restoration, ask the host or technical responder to preserve an affected copy of the site and relevant server logs. A copy can help with investigation and comparison, but it should be stored securely and not served to visitors. Avoid opening suspicious files on a regular work computer.
Preserving a copy is not the same as deciding to restore from it. It is a way to retain a record of the affected state while the team investigates and works on recovery. For broader planning around recovery and keeping operations going, see Zevonix’s disaster recovery guidance.
Secure accounts beyond the WordPress dashboard
Once the host or responder is ready to make access changes, secure the accounts that could control the site. This usually means reviewing WordPress administrator accounts as well as hosting, database, email, domain registrar, DNS, and file-transfer access. Also consider any connected services, such as a content delivery network or tools with keys that can change site content.
- Change passwords from a device you trust, not from a computer that may also be compromised.
- Remove or disable accounts that are unfamiliar or no longer needed, after preserving account details that may help the investigation.
- Review who can access hosting, email, domain settings, and file transfer, not just who can sign in to WordPress.
- Check for other websites in the same hosting environment and ask the host whether they need review.
If you are unsure which access points are involved, get technical help rather than changing accounts at random. A provider familiar with the site’s hosting setup can help coordinate changes and avoid locking out the people responsible for recovery.
Check backups before restoring
A backup can make recovery faster, but it is useful only if it predates the compromise and does not contain the same malicious files or unauthorized changes. Ask the host or responder to help identify a backup from before the earliest signs of suspicious activity and inspect it in a controlled environment before putting it back online.
Check that the backup includes the parts of the site the business needs, such as its files and database, and that the restored site can be reviewed before public access resumes. If there is uncertainty about when the compromise began, restoring the newest backup without checking it may bring the problem back. Zevonix also explains the wider role of backup and continuity planning in its article on business recovery planning.
Clean the site and close the way in
Once evidence is preserved, have a qualified responder inspect WordPress, its themes and plugins, site files, database, user accounts, and hosting environment. Remove malicious changes, update or replace vulnerable components, and review file permissions and account access as appropriate for the setup.
Cleaning visible malware alone is not enough if the entry point remains open. The responder should look for how access may have been gained and whether the same credentials or vulnerable components are used elsewhere. Avoid reinstalling or deleting files before this work is coordinated, since a rushed cleanup can destroy evidence or leave another route into the site.
After cleanup, test the website before returning it to normal use. Check important pages, forms, account functions, redirects, and any connected business processes. Keep an eye out for renewed changes or suspicious activity. For local businesses that need help coordinating IT response, Zevonix’s page on IT support and response describes its support approach.
Review search warnings after cleanup
If search results show a warning or the site has been flagged, first make sure the site is cleaned and safe to visit. Then review the relevant reports in Google Search Console and follow Google’s process for requesting a review. Google’s guidance on what to do after a site is hacked explains investigation and review steps.
Frequently asked questions
Should I take my hacked WordPress website offline?
Not automatically. If visitors may be exposed to harmful content or sensitive information, restrict access or take the site offline while coordinating with the host or responder. Preserve logs and relevant evidence before making changes when possible.
Should I save a copy of the site before cleaning it?
Ask the host or responder to preserve a secure copy and relevant logs before cleanup. Keep that copy out of public access. It can help with investigation, but should not be used as a clean restore point without inspection.
How do I check whether a WordPress backup is clean?
Have a qualified responder identify a backup from before the suspected compromise and inspect it in a controlled environment. Check the files, database, and account state before restoring the site publicly.
Which accounts should I secure after a WordPress hack?
Review WordPress administrator, hosting, database, email, domain registrar, DNS, and file-transfer access. Also review connected services and other sites in the same hosting environment.
How do I get Google to review my site after removing malware?
Confirm the site has been cleaned and corrected, then use Google Search Console to review any security issues and follow its request-review process.
Take a careful first step
A WordPress compromise needs both containment and a recovery plan. Preserve what can help explain the incident, work with the host, secure the wider set of accounts, and verify a backup before restoring. Businesses in Palm Coast, Flagler Beach, Bunnell, and Flagler County can contact Zevonix at (386) 260-0777 to discuss IT support and next steps.