Your WordPress site got hacked: what to do in the first hour

Snapshot first, lock down, rotate credentials, find the entry point, clean or restore, close the door — the order that keeps a hack a one-afternoon problem.

The first hour decides whether this is an afternoon or a month. Here is the order of operations we use on managed plans, written so you can follow it on any host.

If you host with us, open a ticket before step 1 — an engineer will snapshot the container and lock the site down while you read the rest.

1. SnapshotThe compromised state is evidence: it tells you how the attacker got in. Back up files and database before you change anything.
2. Lock downStop visitors and the attacker's bots from reaching the site while you work.
3. Rotate credentialsEvery password and key the site touches, not just the WordPress admin.
4. Find the entry pointRecently changed files, PHP where PHP does not belong, and the access log around that time.
5. Clean or restoreA backup from before the earliest modification date beats cleaning by hand.
6. Close the doorUpdate everything, delete plugins and themes you do not use, turn on two-factor for every administrator.

The first hour, in order. Every step assumes the one before it is finished — the detail for each is below.

1. Snapshot before you touch anything

The instinct is to start deleting suspicious files. Resist it. The compromised state is evidence: it tells you how the attacker got in, and without it you’ll clean the symptoms and get hit again through the same door. Take a full backup of files and database now — a hosting snapshot, or a plain archive:

tar -czf ~/site-compromised-$(date +%F).tgz public_html/
mysqldump -u USER -p DBNAME | gzip > ~/db-compromised-$(date +%F).sql.gz

2. Lock the site down

Stop visitors and the attacker’s bots from reaching the site while you work. Enable maintenance mode at the server level — password-protect the document root, or block everything but your IP. Don’t rely on a WordPress plugin for this: if the attacker has admin, so do they.

3. Rotate every credential

• All WordPress administrator passwords, and delete any admin user you don’t recognise.
• The database password, then update wp-config.php.
• SFTP, hosting panel and any API keys stored in the site (payment gateways, mailers, CDN).
• Rotate the salts in wp-config.php — this logs every session out, including the attacker’s.

4. Find the entry point

Three searches find the majority of infections. Look for recently changed files, PHP where PHP shouldn’t be, and scheduled tasks you didn’t create:

find . -type f -mtime -14 -not -path "./wp-content/cache/*" | head -100
find wp-content/uploads -name "*.php"
wp cron event list   # or check wp_options → cron

Also check .htaccess for redirects, wp_options for a changed siteurl or home, and the theme’s functions.php for code you didn’t write. Note the earliest modification date — that’s roughly when it started, and it tells you which backup is clean.

5. Clean or restore

If you have a backup from before the earliest modification date, restoring it is faster and more reliable than cleaning. If you don’t, replace WordPress core, every plugin and every theme with fresh copies from wordpress.org, keep only wp-content/uploads and wp-config.php (after checking both), and review the database for injected scripts in wp_posts.

6. Close the door

• Update everything, and delete plugins and themes you don’t use — inactive code is still attack surface.
• Turn on two-factor authentication for every administrator.
• If Google flagged the site, request a review in Search Console once it’s clean.
• Keep the snapshot from step 1 for a month, then delete it.

On inSave managed WordPress plans, cPFence blocks the common entry points — vulnerable plugin endpoints, brute-force logins, known malware signatures — at the server level, and automatic updates close known holes before they’re exploited.