Your WordPress Website Was Compromised. What Should You Do Next?
— A WordPress website suddenly redirects visitors to another site.
— Search engines flag it as malicious.
— A security plugin reports unknown files.
— An administrator account appears that nobody created.
— Your hosting provider suspends the site.
The instinct is often:
“Just clean the malware and put the site back online.”
That may solve the visible symptom.
But it does not necessarily solve the security incident.
The most important question is not:
“Where is the malicious file?”
It is:
“How did the attacker get there?”
WordPress itself recommends identifying indicators of compromise and taking a structured approach rather than treating the word “hacked” as a diagnosis
Step 1: Confirm the Symptoms
Common indicators include:
- unauthorized redirects
- malicious JavaScript
- unexpected administrator accounts
- modified themes
- altered plugin files
- unknown PHP files
- spam pages
- SEO poisoning
- hosting suspension
- browser malware warnings
- Google blacklisting
- unexpected outbound traffic
Document what you observe.
Screenshots, timestamps and alerts can become useful later.
Step 2: Contain the Website
If the site is actively serving malware, phishing content or malicious redirects, keeping it online may expose visitors.
Containment options may include:
- placing the site in maintenance mode
- restricting external access
- disabling vulnerable plugins
- revoking suspicious administrative accounts
- temporarily blocking affected services
- restricting administrator access
The objective is to stop continued abuse while preserving enough information to understand what happened.
Step 3: Preserve Evidence Before Rebuilding
A frequent mistake is deleting everything immediately.
Before wiping or rebuilding the site, preserve:
- web server logs
- WordPress logs
- hosting logs
- PHP logs
- firewall/WAF logs
- plugin lists
- user accounts
- suspicious files
- timestamps
- database snapshots
- server snapshots
- cloud snapshots where available
If malware files are found, preserve copies before deletion where appropriate.
Those artifacts may help determine:
- initial access
- persistence
- attacker infrastructure
- affected users
- data access
- whether the compromise extended beyond WordPress
Step 4: Determine How the Attacker Got In
Possible entry points include:
- vulnerable plugins
- outdated themes
- weak passwords
- credential theft
- reused passwords
- compromised administrator accounts
- exposed hosting credentials
- insecure FTP
- vulnerable hosting components
- malicious plugins/themes
WordPress’s official hardening guidance emphasizes keeping WordPress updated, maintaining secure passwords, using two-step authentication, limiting permissions, maintaining backups, logging and monitoring. WordPress Developer Resources
Simply removing the malware without correcting the original access path can allow the attacker to return.
Step 5: Look for Persistence
Attackers frequently leave more than one way back in.
Investigators should search for:
- unauthorized administrator accounts
- malicious cron jobs
- modified PHP files
- backdoors
- obfuscated code
- altered
.htaccess - malicious plugins
- web shells
- unexpected SSH keys
- unknown scheduled tasks
Do not assume the first suspicious file you find is the only one.
Step 6: Determine Whether Credentials Were Exposed
WordPress compromises can involve more than website files.
Ask whether the attacker could have obtained:
- WordPress administrator credentials
- hosting credentials
- database passwords
- API keys
- SMTP credentials
- cloud credentials
- FTP/SFTP credentials
If credentials may have been exposed, they should be rotated.
That may include credentials stored in configuration files.
Step 7: Determine Whether Data Was Accessed
Not every WordPress compromise involves sensitive data.
But some WordPress sites contain:
- customer records
- contact forms
- user accounts
- payment integrations
- healthcare information
- uploaded documents
- email addresses
- CRM integrations
If sensitive data was accessible, the investigation should determine whether evidence suggests unauthorized access or extraction.
That question may have legal or regulatory consequences.
Step 8: Rebuild From a Known-Good State
Once the incident is understood, rebuild using trusted sources.
That may include:
- clean WordPress core
- verified themes
- verified plugins
- trusted database backups
- new credentials
- updated configuration
WordPress recommends maintaining regular snapshots of both the WordPress installation and database specifically so organizations have trusted recovery points after a compromise. WordPress Developer Resources
Do not simply restore the newest backup without asking:
Was the attacker already present when this backup was created?
Step 9: Harden Before Going Back Online
Before returning the site to production:
- update WordPress
- update plugins
- update themes
- remove unused plugins
- remove unused accounts
- enable MFA
- restrict administrative access
- review permissions
- enable logging
- implement WAF protections
- monitor file integrity
- protect backups
Recovery should improve the security posture.
Otherwise the organization may restore the same weaknesses that enabled the compromise.
WordPress Cleanup vs. Digital Forensics
A site-cleaning service may successfully remove malware.
That is valuable.
But a forensic investigation answers a different set of questions:
How did the attacker enter?
When did they enter?
What did they change?
Did they establish persistence?
Were credentials compromised?
Was data accessed?
Could the attacker return?
For organizations where the website supports business operations, regulated data, litigation or customer transactions, those questions matter.
Velocis WordPress DFIR
Velocis DFIR can help investigate compromised websites and supporting infrastructure using evidence from:
- hosting environments
- WordPress
- server logs
- databases
- identity systems
- cloud services
- endpoint systems
- security telemetry
The goal is not simply to make the website appear clean.
It is to understand the compromise and reduce the chance that it happens again.