After a WordPress hack, the priority is to preserve a copy, contain access, identify the entry point, clean the site, reset credentials and reduce the chance of the same compromise returning.
1. Preserve a copy first
Before deleting files, take a copy of the site and database. It may be infected, but it gives you a reference point and can help identify when the compromise happened.
2. Limit access
Change hosting, WordPress admin, database, FTP/SFTP and control panel passwords from a trusted device. Remove unknown users and check whether admin accounts have unexpected email addresses or roles.
3. Identify what changed
Look for recently modified files, unknown plugins, injected code, spam pages, altered `.htaccess` rules and suspicious files in uploads. Cleanup should include the database as well as the file system.
4. Clean and update carefully
Replace WordPress core files from a clean source, update legitimate plugins and themes, remove abandoned components and repair affected templates. Avoid keeping old copies of vulnerable plugins inside public directories.
5. Check the site after cleanup
Test forms, checkout flows, admin login, search results, redirects and security warnings. If Google or browsers flagged the site, request review only after the cause has been addressed.
6. Harden the site
Review backups, permissions, admin access, plugin choices and hosting isolation. A cleanup without hardening often leads to repeat compromise.
How TechThisOut can help
Our hack cleanup service supports investigation and cleanup, while security audits help reduce future risk.
Need help after a hack?
We can help assess the symptoms and plan a safer recovery route.
