This article is part of the WordPress Forensics series — practical guides for WordPress security, recovery, and migration.

Introduction

Your site has been hacked. Search engines are showing spam results. Visitors see a defacement page. Or worse — it looks normal but is quietly serving malware. Here is the systematic recovery process we use to clean WordPress sites and prevent reinfection.

Phase 1: Immediate Response (First Hour)

Step 1: Confirm the Hack

  • Screenshot everything you see
  • Check Google Search Console for security warnings
  • Review hosting provider notifications
  • Scan with Sucuri SiteCheck or similar

Step 2: Take the Site Offline

Options in order of preference:

  1. Enable maintenance mode via hosting panel
  2. Add .htaccess rule to block all access
  3. Rename wp-config.php temporarily
  4. Delete index.php as last resort

Step 3: Preserve Evidence

  • Download complete file backup (infected state)
  • Export database
  • Save access logs
  • Note timestamps of modified files

Step 4: Change All Passwords

  • Hosting panel password
  • FTP/SFTP passwords
  • Database password
  • WordPress admin passwords (all users)
  • Any integrated services (email, payment)

Phase 2: Assessment (Hours 1-4)

Step 5: Identify Entry Point

Common attack vectors:

  • Vulnerable plugin (check recently updated/installed)
  • Outdated WordPress core
  • Compromised credentials (reused passwords)
  • Vulnerable theme
  • Hosting-level compromise (shared hosting)

Step 6: Determine Scope

  • How many files are infected?
  • Is the database compromised?
  • Are other sites on the same hosting affected?
  • How long has the infection been present?

Step 7: Find Clean Backup

  • Identify last known clean backup date
  • Verify backup integrity
  • Determine what content was added after backup

Phase 3: Cleanup (Hours 4-12)

Option A: Restore from Clean Backup

Best for: Severe infections, recent backup available

  1. Restore files from clean backup
  2. Restore database from clean backup
  3. Manually add content created after backup date
  4. Update WordPress, themes, and plugins immediately
  5. Change all credentials again

Option B: Manual Cleanup

Best for: Light infection, no recent backup

File Cleanup

  1. Replace wp-includes and wp-admin with fresh copies
  2. Review and clean wp-config.php
  3. Check .htaccess against default
  4. Remove unknown files from wp-content
  5. Reinstall themes from trusted source
  6. Reinstall plugins from trusted source
  7. Check uploads directory for PHP files

Database Cleanup

  1. Remove rogue admin accounts
  2. Clean wp_options of injected code
  3. Search posts/pages for malicious scripts
  4. Check and clean wp_usermeta
  5. Reset authentication keys (forces logout of all users)

Phase 4: Hardening (Hours 12-24)

Step 8: Core Hardening

  • Update WordPress to latest version
  • Update PHP to latest supported version
  • Set correct file permissions (755/644)
  • Disable file editing in wp-config.php
  • Change database table prefix (if feasible)

Step 9: Plugin and Theme Hardening

  • Remove all unnecessary plugins
  • Remove all unused themes
  • Update remaining plugins and themes
  • Audit each plugin for known vulnerabilities

Step 10: Access Control

  • Implement two-factor authentication
  • Limit login attempts
  • Change admin username if "admin"
  • Use strong, unique passwords
  • Restrict wp-admin by IP if feasible

Step 11: Monitoring

  • Install security plugin (Wordfence, Sucuri)
  • Enable file integrity monitoring
  • Set up login notifications
  • Configure regular automated backups

Phase 5: Verification and Relaunch

Step 12: Verify Cleanup

  • Run multiple malware scanners
  • Check Google Search Console for issues
  • Test all site functionality
  • Review security headers
  • Verify SSL certificate

Step 13: Remove Blacklistings

  • Request Google review (Search Console)
  • Check other blacklist services
  • Notify hosting provider cleanup is complete

Step 14: Document and Learn

  • Document the attack timeline
  • Record how entry occurred
  • Note all remediation steps taken
  • Implement preventive measures

Preventing Reinfection

  • Monthly security audits
  • Automatic updates enabled where safe
  • Regular backup verification
  • Monitoring and alerting active
  • Annual penetration testing

Conclusion

Recovery from a hack is stressful but methodical. Resist the urge to rush — incomplete cleanup leads to reinfection. Take the time to understand how the breach occurred, clean thoroughly, and harden against future attacks.