WordPress Hacked Site Emergency Checklist

A short checklist for the first response to a WordPress compromise. Work from top to bottom and tick things off. Ticks aren't saved when you close the page, so print it if you need a record.

Print this checklist

Stabilise

• Preserve a copy or snapshotDownload all files and a database export before changing anything. Keep them untouched.
• Document the symptomsWhat you saw, when, on which pages and devices. Screenshots help.
• Review hosting alertsRead any malware notice or suspension email; ask the host for logs and flagged file paths.
• Take the site offline if it harms visitorsMaintenance mode, or ask the host. Short outage beats infecting customers.
• Avoid randomly deleting filesDeleting removes evidence and often leaves the real problem behind.

Investigate

• Identify affected accountsWhich logins were involved? Which accounts were created or changed?
• Review WordPress administratorsNote any you don't recognise before removing them. See unknown admin users.
• Review plugins and themesAnything unfamiliar, outdated, abandoned or pirated is a suspect.
• Plan credential rotationWordPress, hosting, SFTP/SSH, database and email, from a clean device. Include the salts.
• Investigate malwareCore integrity, recently changed files, PHP in uploads, injected content in the database.
• Investigate persistenceBackdoors, hidden users, scheduled tasks, mu-plugins. See WordPress backdoors.

Recover

• Clean the siteRemove malicious code and replace modified files with clean copies. See the cleanup checklist.
• Rotate credentials and saltsDo it after cleaning, so new passwords aren't stolen again.
• Update or remove vulnerable componentsClose the likely entry point.
• Validate the cleanupRe-test the original symptom, re-run integrity checks, check what search engines see.

Afterwards

• Harden the siteSee securing WordPress after malware removal.
• Monitor for recurrenceCheck weekly for a month; set alerts for new administrators and file changes.
• Handle search-engine and browser warningsRequest a review once the site is clean.

Want it handled for you?

If you're stuck on a step, or the site is too important to experiment on, WordPress malware removal starts from $199. Hacked-site recovery explains how it runs. Prefer to read more first? The The Complete WordPress Hacked Site Recovery Guide covers each stage in depth.