WordPress site hacked?
First understand what happened
Unexpected redirects, spam pages, unknown administrator accounts or malware warnings are signs that need a technical investigation. Removing the visible symptom is not enough if the original access path is still open.
What to do first
A compromised site should not be handled by randomly deleting files or reinstalling plugins until the homepage looks normal again.
The priority is to preserve useful evidence, reduce unnecessary access and understand which part of the installation, hosting or credential chain was involved.
- Do not destroy evidence
Take note of redirects, warnings, changed files, unknown users and timestamps before cleanup.
- Reduce unnecessary access
Limit administrative access while keeping the information needed for the investigation available.
- Use trusted sources
Core, plugins and themes should be compared with clean, official or otherwise trusted copies.
- Rotate credentials at the right time
WordPress, hosting, database and SSH or SFTP credentials may all be involved, depending on what the investigation finds.
Signs that deserve investigation
None of these signals alone explains the cause of an incident, but each is a reason to inspect the installation and the infrastructure behind it.
Unexpected redirects
Visitors or search engines are sent to unrelated domains or pages.
Spam pages in search results
Google indexes content you never published, often around gambling, pharmaceuticals or fake products.
Unknown administrators
New administrator accounts or privilege changes appear without an authorized action.
Malware warnings
Browsers, hosting providers or security tools report malicious code or suspicious downloads.
Unauthorized changes
Plugins, themes, files or scheduled tasks change without a legitimate explanation.
Hosting or search engine blocks
The provider suspends the site or a search engine marks it as dangerous.
WordPress recommends documenting indicators of compromise before recovery work begins.
How we handle the recovery
The work follows a technical sequence so that cleanup, credential rotation and hardening are based on what was actually found.
Contain and document
Record the symptoms, reduce unnecessary access and preserve useful evidence before changing the installation.
Identify the access path
Review core, plugins, themes, users, hosting, logs, credentials and exposed services to understand what was involved.
Remove malicious persistence
Rebuild or clean affected components from trusted sources and remove unauthorized users, files, tasks or configuration.
Restore access and trust
Rotate the relevant credentials, verify permissions and confirm that unauthorized access is no longer present.
Harden and monitor
Update supported software, reduce attack surface, review backups and monitor the site after recovery.
Technical checks
- WordPress core, plugins and themes
- Administrator users and privilege changes
- Modified files, uploads and suspicious PHP
- wp-config.php and persistence points
- Web server, PHP and filesystem permissions
- Logs, redirects and public indicators
After the cleanup
A recovery is complete only when the site has been restored from trusted components, access has been reviewed and the conditions that made the incident possible have been reduced.
- Supported and updated WordPress, plugins and themes
- Reviewed administrator access and credentials
- Backups separated from the production site
- Server and security configuration reviewed
- Post-recovery monitoring
Three things to avoid
Reinstalling only the plugin that looks suspicious
It can remove one visible symptom while another persistence mechanism or compromised account remains active.
Restoring the latest backup blindly
A recent backup may already contain the compromise. The recovery point must be one you can reasonably trust.
Assuming the incident is solved because the site loads
A normal homepage does not prove that malicious code or unauthorized access has been removed.
Official WordPress references
The recovery and hardening approach described here follows the principles documented by the WordPress project.
Do you need to understand what happened?
We can check WordPress, hosting and the most relevant public and server-side indicators before defining the recovery path.