WordPress Hacked? What to Do in the First 24 Hours

Discovering that a WordPress site has been hacked is stressful. Visitors may be redirected to spam, search results may show strange pages, a browser may display a warning, or your host may suspend the account. The first day matters because rushed actions, such as deleting files at random or restoring an old backup over the top, can destroy useful information and leave the original entry point open. This guide sets out a calm, ordered checklist for the first 24 hours.

What It Is

A WordPress compromise usually means someone has gained the ability to change files, the database, or user accounts. Common signs include unknown administrator users, unfamiliar plugins or files, injected JavaScript, spam pages indexed by search engines, redirects that only affect some visitors, outgoing spam email, or warnings from a browser or search engine. Frequent entry points include outdated or abandoned plugins and themes, reused or weak passwords, compromised hosting or FTP credentials, and insecure file permissions. The first 24 hours are about confirming what is happening, limiting further harm, keeping a record, and preparing for a proper cleanup. The detailed file-by-file cleanup follows as its own step.

Who It Is For

This checklist is for:

Business owners and marketing teams who manage a WordPress site without a dedicated security team
Agencies supporting a client site that has just been reported as compromised
In-house IT staff who have received a hosting suspension notice or browser warning
Anyone who needs to brief a provider clearly before cleanup work begins

What It Helps Clarify

Following the checklist helps clarify:

Whether the site is actually compromised or showing a configuration or plugin fault
What has changed, when, and which accounts may be involved
Who owns the hosting, domain, DNS, and backups, and who can authorise changes
Whether customer data or payment flows could be affected and need separate attention

What's Included

Hour 0-2: write down what was noticed, when, and by whom; take screenshots of warnings, redirects, and unfamiliar pages
Hour 0-2: identify who controls hosting, domain registrar, DNS, CDN, and the WordPress admin
Hour 1-4: take a full copy of files and the database as they are now, and store it separately; do not overwrite older backups
Hour 1-4: consider placing the site in maintenance mode or asking your host to restrict access if visitors are being harmed
Hour 2-6: from a clean device, change passwords for hosting, FTP/SFTP, database, and WordPress administrators; enable MFA where available
Hour 2-6: review WordPress users and remove or disable accounts you do not recognise, noting what you removed
Hour 4-12: collect available server access logs and hosting security notices
Hour 6-24: brief a qualified provider with your notes, logs, and backup copy, and agree a cleanup scope

What's Not Included

Malware-removal commands or instructions to edit core files without a backup
Legal advice on whether a data breach notification is required
A claim that changing passwords alone resolves the compromise
Advice to contact or retaliate against the attacker

When to Choose It

Use this checklist as soon as you suspect a compromise, before you start deleting files or restoring backups. If the site processes payments or stores customer personal data, involve whoever is responsible for privacy and legal obligations early; notification duties depend on the facts and the jurisdiction, and this article is not legal advice. If the hosting provider has suspended the account, ask what they need from you to restore access and whether they hold logs you can use.

Our Approach

Prioritise containment and record-keeping over speed of visual cleanup. A site that looks normal again can still contain a backdoor that lets the attacker return within days. Restoring an old backup without closing the entry point often leads to reinfection. Once the initial steps are complete, the cleanup should cover files, database, users, scheduled tasks, and the server configuration, followed by closing the entry point and hardening. Our Incident Recovery service provides an initial review and classification of an agreed website or WordPress issue, hands-on containment, cleanup of malicious code, backdoors and unauthorised users, secure restoration, closure of the identified entry point, and a written report with hardening recommendations. It is scoped work for the confirmed website, with legal determinations handled by your legal adviser. Whoever helps you, ask them to explain what they found and changed, and keep that report with your notes.

Incident Recovery

View the Incident Recovery service page