My WordPress site was hacked: what to do now

If your WordPress site was hacked, do not start deleting things. Write down what you are seeing, contact your hosting provider, take a copy of the site as it is, and change every password. Then clean or restore the site and close the gap the attacker used. The steps below follow the order in WordPress.org's own guidance, written for a business owner. If the site takes payments or stores personal information, get professional help early.

Signs a site has been hacked

WordPress.org lists these as common indicators:

• A warning from Google, a browser or antivirus software when visiting the site
• The hosting provider has suspended the account
• Visitors are redirected to another site
• New administrator users that nobody created
• Pages, links or content that changed without anyone editing them
• Reports that the site is sending spam or attacking other sites

Some of these have innocent causes. A hosting fault or a broken plugin can look like a hack. That is one reason to speak to the host before assuming the worst.

First steps, in order

1. Stay calm and write it down

Record what you see, when you first noticed it, and what changed on the site recently: new plugins, updates, new users, edits. Take screenshots. These notes save time for whoever cleans the site.

2. Contact your hosting provider

Ask three things:

• Is this a hack or a server problem?
• Are other sites on the same server affected?
• What backups do you hold, and from which dates?

If the site is redirecting visitors or serving malware, ask the host to take it offline or restrict access while you work. A site that is briefly unavailable does less damage than one that is infecting visitors.

3. Take a copy of the site as it is

Back up the files and database in their infected state before cleaning anything. WordPress.org recommends this snapshot because it is your reference if the clean-up goes wrong, and it is the evidence of how the attacker got in.

4. Scan the computers you use

Run a full antivirus scan on every computer used to log in to the site. Attackers often get in through passwords stolen from an infected computer. If you change passwords on a compromised machine, the new ones are stolen too.

5. Change every password

Change all of these, from a clean computer:

• Every WordPress user account, not only your own
• The hosting control panel
• FTP or SFTP accounts
• The database user
• The email accounts linked to administrator users

Use long, unique passwords from a password manager, and switch on two-factor authentication. Regenerate the WordPress secret keys in the wp-config.php file as well. This signs out everyone who is logged in, including the attacker.

6. Scan the site

Use two kinds of scanner, as WordPress.org suggests: a security plugin that scans from inside the site, and a remote scanner that checks it from outside. Each finds things the other misses. A clean scan is a good sign, not proof.

Cleaning the site

There are two routes.

Restore a clean backup

This is often the fastest. It only works if the backup was taken before the break-in, and that date is not always obvious, because some infections sit quietly for weeks. Anything added since the backup is lost, including orders and form entries. The weakness the attacker used comes back with the restore, so the steps in the next section still apply.

Clean the existing site

This is technical work. WordPress.org's guidance includes:

• Replace the WordPress core files with fresh copies of the same version, uploaded by hand, so injected files are not left behind.
• Reinstall each plugin and theme from its original source.
• Inspect the wp-content folder, the .htaccess file and the theme's main files for code that should not be there.
• Remove unknown users and check the database for injected content.

The official steps are in the WordPress.org hacked site guide.

After the clean-up

1. Update WordPress, every plugin and the theme to current versions.
2. Delete plugins and themes that are not in use.
3. Change all passwords a second time, now that the site is clean.
4. Work out how the attacker got in. Without this, the same door is still open.
5. If Google is showing a warning, open the Security Issues report in Search Console and request a review. Google explains the process in its malware and unwanted software documentation.
6. Put regular backups, updates and monitoring in place. The routine is in the monthly WordPress maintenance checklist.

If personal information was exposed

If the site holds personal information, such as customer accounts, orders, patient enquiries or form submissions, a hack may also be a data breach with legal duties attached.

In South Africa, section 22 of POPIA requires a responsible party to notify the Information Regulator and the affected people as soon as reasonably possible when there are reasonable grounds to believe personal information was accessed by an unauthorised person. The Information Regulator publishes the notification process. Other countries have their own rules.

This is general information, not legal advice. Speak to your own legal adviser about what applies to you.

When to get professional help

Get help when:

• The site takes payments or holds personal information
• You have no backup, or cannot tell which backup is clean
• The infection comes back after you clean it
• You are locked out of the admin area
• The host has suspended the account
• You are not comfortable working with files and a database

A repeat infection almost always means something was missed, and each attempt gives the attacker more time.

Stryx handles hacked sites as emergency fixes, with ongoing protection covered under website security. Support hours are Monday to Friday, 8:00 to 17:00 South African time. Contact Stryx with what you have noted so far.