The first hours are about decisions more than technical work: how much harm is happening, what to keep, who needs to know and who will do the cleanup. This guide covers those decisions. For a tick-off list of tasks, see the emergency checklist.
Decide how much harm is being done right now
Two questions set your urgency. Is the site harming visitors, for example by redirecting them to scams or serving malicious downloads? And is customer data or payment information at risk? If the answer to either is yes, take the site offline or put it in maintenance mode while you work. A short outage is cheaper than harming customers and being flagged by browsers.
Preserve before you fix
Take a full copy of the files and the database before changing anything, and keep a copy of any logs your host offers. Deleting suspicious files first destroys the evidence that shows how the attacker got in, and makes it likelier the cleanup is incomplete.
Tell the right people
- Your host. They may have logs, a scanner report and a quarantine process, and they may already be about to act. See WordPress Website Suspended for Malware: Recovery Guide.
- Whoever manages the site. Agencies and freelancers need to know, and may be able to help.
- Your team. People with accounts on the site should change credentials and watch for phishing.
- Legal or data-protection contact. If personal data may be involved, data-protection law, including the Swiss revFADP and the GDPR, can require reporting a breach, sometimes within tight deadlines. Raise it early, even if you later find it wasn't needed.
- Customers. Decide what to say, and when, if their data or trust is in play.
Contain access from a clean device
If your own computer might be infected, use another device. Change WordPress administrator, hosting, SFTP/SSH, database and email passwords, and replace the salts in wp-config.php to end existing sessions. Review who has administrator access (see Unknown Admin User in WordPress: What to Do).
What not to do
- Don't restore a backup blindly. It may contain the same backdoor. See Why Restoring a Backup May Not Fix a Hacked WordPress Site.
- Don't delete files at random, or run several cleanup plugins at once.
- Don't pay anyone who promises an instant fix without explaining what they'll check.
- Don't email passwords to a helper. Use temporary accounts.
Choose who does the cleanup
If you have the skills and time, the WordPress Malware Cleanup Checklist and the The Complete WordPress Hacked Site Recovery Guide will take you through it. If the site is business-critical, or it keeps returning, bringing in a specialist is usually quicker. Hacked-site recovery and malware removal start from $199.
Plan the first 24 hours
| When | Focus |
|---|---|
| First hour | Contain harm, take copies, change credentials, tell the host |
| Hours 2 to 6 | Investigate: users, files, plugins, logs. Decide DIY or specialist |
| Hours 6 to 24 | Clean, rotate, close the entry point, verify, bring the site back |
| Next days | Search-engine recovery, hardening, monitoring |
Further reading
Dealing with this on a live site?
Send us the details and we'll tell you what we'd do and what it would cost.