Fixing a Hacked Site

Recovering a hacked WordPress site involves more than removing the first suspicious file or user. The investigation needs to identify affected files and accounts, remove unauthorised access and address how the compromise happened.

Document what you can see

• Record warnings, redirects, unfamiliar content and the time they appeared.
• Save relevant hosting, firewall and WordPress security alerts.
• Note recent plugin, theme, user or hosting changes.
• Create a copy of the affected site before cleanup when it is safe to do so.

Protect visitors and regain control

1. Restrict the site appropriately if it is exposing harmful content or customer data.
2. Use a clean device to secure administrator email, hosting, registrar and WordPress access.
3. Review administrator accounts, active sessions and access methods.
4. Identify changed files, database entries, scheduled tasks and server rules.
5. Replace affected WordPress core, theme and plugin code from trusted sources.
6. Remove unauthorised access and rotate credentials again after the environment is clean.

Prevent the site being compromised again

Update supported software, remove unused components, correct vulnerable configuration and review logs for the original entry point. Test the website and monitoring before returning it to normal use. A backup can help recovery, but restoring without closing the entry point can allow reinfection.

Read Website Hacking and Malware for wider incident guidance. Shield Pro includes malware prevention and removal, or you can submit a Fix Request for developer help.