WordPress site hacked?
Restore the site safely
Unexpected redirects, spam pages, unknown administrator accounts or malware warnings can require technical restoration of the website. Our scope is the web product: clean components, access, updates, configuration and recovery. We do not provide digital forensics or incident-response investigations.
What to do first
A compromised site should be restored from trusted components rather than fixed by randomly deleting files until the homepage looks normal again.
If a forensic investigation is required, it should be handled by a dedicated security provider before the environment is changed. Our work starts from technical website recovery and hardening.
- Before changing files
If forensic evidence must be preserved, involve a specialist first. Our scope begins with technical website recovery.
- Reduce unnecessary access
Limit administrative access while keeping the information needed for the investigation available.
- Use trusted sources
Core, plugins and themes should be compared with clean, official or otherwise trusted copies.
- Rotate credentials at the right time
WordPress, hosting, database and SSH or SFTP credentials may all be involved, depending on what the investigation finds.
Technical symptoms to check
None of these symptoms proves a root cause, but each can justify checking the WordPress installation, hosting configuration and access needed to restore the site.
Unexpected redirects
Visitors or search engines are sent to unrelated domains or pages.
Spam pages in search results
Google indexes content you never published, often around gambling, pharmaceuticals or fake products.
Unknown administrators
New administrator accounts or privilege changes appear without an authorized action.
Malware warnings
Browsers, hosting providers or security tools report malicious code or suspicious downloads.
Unauthorized changes
Plugins, themes, files or scheduled tasks change without a legitimate explanation.
Hosting or search engine blocks
The provider suspends the site or a search engine marks it as dangerous.
These checks support technical restoration; they are not a forensic assessment of the attack.
How we restore the website
The work follows a technical sequence focused on restoring trusted code, reviewing access, updating components and reducing obvious configuration weaknesses.
Stabilize the website
Reduce unnecessary administrative access and prepare a recoverable copy of the website before rebuilding components.
Rebuild from trusted components
Replace affected core files, plugins and themes with clean copies from official or otherwise trusted sources.
Review access and configuration
Remove unauthorized accounts, rotate relevant credentials and review permissions and configuration needed by the website.
Update the stack
Bring WordPress, plugins, themes and supported runtime components to maintained versions where compatible.
Harden and verify
Reduce unnecessary exposure, review backups and verify the main site flows after recovery.
Technical checks
- WordPress core, plugins and themes
- Administrator users and privilege changes
- Modified files, uploads and suspicious PHP
- wp-config.php and persistence points
- Web server, PHP and filesystem permissions
- Redirects and server configuration
After the cleanup
A recovery is complete only when the site has been restored from trusted components, access has been reviewed and the conditions that made the incident possible have been reduced.
- Supported and updated WordPress, plugins and themes
- Reviewed administrator access and credentials
- Backups separated from the production site
- Server and security configuration reviewed
- Post-recovery monitoring
Three things to avoid
Reinstalling only the plugin that looks suspicious
It can remove one visible symptom while another persistence mechanism or compromised account remains active.
Restoring the latest backup blindly
A recent backup may already contain the compromise. The recovery point must be one you can reasonably trust.
Assuming the incident is solved because the site loads
A normal homepage does not prove that malicious code or unauthorized access has been removed.
Official WordPress references
The recovery and hardening approach described here follows the principles documented by the WordPress project.
Do you need to restore the website?
We can restore WordPress from trusted components, review access and configuration, update the stack and verify that the website works correctly again. For forensic or incident-response work, a specialist security provider is required.