What to do when a WordPress site is hacked

Updated · 31 Aug 2026

Short answer.

After a suspected compromise, contain damage and preserve available evidence before deleting random files. Identify affected accounts and systems, restore from trusted sources, rotate secrets, and prove the entry point is closed. Installing a security plugin alone does not prove that the site is clean.

Check first

Evidence before change.

• What appeared and when: redirects, new users, files, mail, load, or a hosting warning.
• Whether a recent checkpoint exists and current files/logs can be preserved separately.
• Who can access WordPress, hosting, domain control, mail, database, CDN, and external APIs.
• Which secrets may be exposed and where they are reused.
• Whether mutable functions can be temporarily restricted without destroying evidence.
• Whether trusted sources exist for core, plugins, theme, and custom code.

Safe sequence

Move in small verifiable steps.

• Contain damage. Use maintenance mode, block a compromised account, or stop malicious sending when needed.
• Preserve state. Keep file, database, and available-log copies outside the working directory.
• Rotate secrets. Use a clean device and include WordPress salts, hosting, database, mail, APIs, and administrators.
• Restore trusted code. Do not stop after deleting one discovered file.
• Close the entry and observe. Fix the vulnerable component/process and review jobs, users, and recurring signs.

Common mistakes

What usually increases risk.

• Deleting a discovered file before preserving context and calling the incident closed.
• Changing only the WordPress password while reusing credentials in mail or hosting.
• Restoring an old copy without closing the original entry point.
• Promising no hidden persistence without sufficient investigation.

320px Site Audit

What can be checked automatically.

Site Audit is read-only and can report selected version, permission, executable-file, user, and configuration signals. It is not antivirus, penetration testing, or digital forensics, and a sensitive report should not be published.

When help is useful

A concrete next step.

For reversible recovery and migration, see WordPress recovery. A specialist is required when forensic scope and incident attribution matter.