A hacked WordPress website needs a controlled recovery process. Deleting a suspicious plugin or restoring an old backup may hide the visible symptoms while leaving the attacker\u2019s access or the original vulnerability in place. Managed WordPress providers commonly combine scanning, clean core files, credential rotation, backups, and post-cleanup hardening. Site owners still need a clear recovery checklist.<\/p>\n
Record what you observed, when it started, which URLs are affected, and any alerts or screenshots. If possible, put the site into maintenance mode or restrict access while you investigate. Avoid repeatedly deleting files, reinstalling plugins, or resetting the database before collecting logs and making a copy; those actions can remove evidence and make the infection harder to understand.<\/p>\n
Change credentials from a trusted device if you believe they were exposed. Prioritize WordPress administrators, hosting control-panel users, SFTP or SSH accounts, database credentials, deployment keys, and API tokens. Do not reuse the same password across services.<\/p>\n
Identify whether the issue is limited to one file, a plugin or theme, administrator access, the database, or multiple sites in the same account. Review recently modified files, new users, unknown cron jobs, web-server logs, and outbound requests. A visible redirect is often only one part of the compromise.<\/p>\n
Restoring from a backup is useful when the infection date is known and the backup is clean. Do not automatically restore the newest backup: it may contain the same backdoor. Confirm that the restored WordPress core, plugins, themes, uploads, and database are compatible and then patch them before returning the site to public traffic.<\/p>\n
Replace WordPress core files with a clean copy. Reinstall plugins and themes from trusted developer sources rather than reusing modified files. Treat nulled or pirated software as a high-risk source of reinfection. Review uploads for executable files and inspect the database for injected options, posts, users, and scripts.<\/p>\n
Search for unknown administrator accounts, altered configuration, hidden PHP files, modified web-server rules, scheduled tasks, deployment keys, and API tokens. Check other sites in the same hosting account when there is evidence that shared credentials or writable directories could allow cross-site access.<\/p>\n
Managed WordPress providers may offer malware scans, cleanups, backups, isolated environments, or support-led remediation. Coverage differs by provider and may exclude unsupported software, custom scripts, or nulled plugins. Read the service terms and understand what the hosting team will inspect, what you must change, and what happens if a cleanup is incomplete.<\/p>\n
WebyStrata helps businesses choose hosting and recovery practices that match the importance of their WordPress sites. The goal is not only to remove today\u2019s symptoms, but to make the next incident easier to detect, contain, and recover from.<\/p>\n