- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
A hacked WordPress website is a security incident.
The correct response depends on scope, data sensitivity, legal obligations and whether the server or other systems are also affected.
1. Contain the Incident
Protect users and evidence.
Depending on severity:
- Put the site into controlled maintenance.
- Restrict administrative access.
- Block malicious traffic.
- Disable a compromised integration.
- Contact the hosting provider.
- Prevent outgoing spam or payments.
- Preserve logs and snapshots.
Do not destroy the only evidence before understanding the incident.
2. Establish Scope
Determine:
- When suspicious activity began.
- Which sites and accounts are affected.
- Whether personal or payment data is involved.
- Whether the host, database, DNS or email is compromised.
- Which files and records changed.
- Whether persistence remains.
- Whether other environments share credentials.
3. Use a Clean Recovery Source
Replace WordPress core from an official package.
Reinstall themes and plugins from trusted sources or deploy clean versions from version control.
Review custom code and database content rather than assuming file replacement removes every malicious change.
4. Rotate Credentials
After the environment is clean, rotate:
- WordPress passwords.
- Email and identity credentials.
- Database credentials.
- Hosting and SFTP accounts.
- API keys.
- Application passwords.
- WordPress salts.
- CDN and DNS access.
Revoke sessions and remove unknown users.
5. Fix the Entry Point
Update or remove vulnerable software, repair permissions, secure accounts and close exposed services.
Without root-cause remediation, the site can be compromised again.
6. Restore and Verify
Test:
- User accounts.
- Files and database.
- Forms and email.
- Scheduled tasks.
- Search results.
- Backups.
- Logs.
- External integrations.
- Security monitoring.
Monitor closely after return to service.
7. Communicate and Learn
Follow applicable legal, contractual and user-notification requirements.
Record the timeline, decisions, root cause, impact and improvements.
Frequently Asked Questions
Should passwords be changed immediately?
Contain access promptly, but rotate them again after the environment is clean so new credentials are not captured by remaining malware.
Can I restore a backup and finish?
A backup can restore service, but the entry point and any compromised external credentials must still be addressed.
Continue Learning
Previous: [How to Check WordPress for Malware](/resources/wordpress-manual/security/check-wordpress-malware/)
Next: [WordPress Security Checklist](/resources/wordpress-manual/security/security-checklist/)