Discovering that your WordPress website has been hacked can be alarming. You may notice unfamiliar pages, redirects, spam in search results, new administrator accounts, or warnings from your browser. In other cases, nothing looks wrong even though an attacker has installed a hidden backdoor.
Act quickly, but do not start deleting files at random. A compromised website must be investigated, cleaned, and secured carefully to prevent data loss or reinfection.
Preserve a Backup and Restrict Access
Before changing the website, create a complete backup of its files and database. Even an infected backup can help a professional determine what changed or recover important content. Download it to a secure location instead of leaving it inside the publicly accessible website directory.
If the site is redirecting visitors, distributing malware, or exposing sensitive information, place it in maintenance mode or ask your hosting provider to restrict access. Notify appropriate parties if customer or employee information may have been exposed.
Update WordPress, the Theme, and Every Plugin
Outdated software is one of the first things to investigate when a WordPress website is hacked. After preserving a backup, update WordPress core, the active theme, and every installed plugin. Delete unused themes and plugins rather than merely deactivating them.
Obtain replacement files only from WordPress.org, the original developer, or another trusted source. Do not reinstall a “nulled” premium theme or plugin, since unauthorized copies may contain malicious code.
Updating closes known vulnerabilities, but it does not necessarily remove malware already on the server. The website still needs to be scanned and inspected.
Inspect Regular and Must-Use Plugins
Using your hosting file manager or SFTP, inspect both of these directories:
wp-content/plugins/wp-content/mu-plugins/
The first contains regular plugins. The second contains must-use plugins, which are loaded automatically. The mu-plugins directory may not exist unless a developer, host, or attacker created it.
Must-use plugins can be easy to overlook because they are listed separately in the WordPress dashboard and cannot be deactivated like ordinary plugins. Review every plugin and compare it with your records. An unfamiliar plugin is not automatically malicious because hosting companies sometimes install legitimate management tools. Do not delete one until you have identified its purpose or consulted your host.
WordPress provides additional information about how must-use plugins work.
Review Administrators and Reset Credentials
In the dashboard, open Users > All Users and examine every account with the Administrator role. Remove unauthorized accounts after preserving any information needed for the investigation. A professional may also need to inspect the WordPress database because attackers can manipulate account records directly.
Reset the password for every legitimate administrator using a long, unique password. Also change the passwords for your hosting panel, SFTP or SSH access, database, and related email accounts. Never reuse the new passwords elsewhere.
Replace the WordPress security keys and salts in wp-config.php to invalidate existing login sessions. Once the site is confirmed clean, reset the passwords again and enable two-factor authentication for administrators.
Run Wordfence and Imunify360 Scans
Install Wordfence Security from the official WordPress plugin directory and run a complete scan. Wordfence can identify malware signatures, backdoors, suspicious administrator accounts, altered WordPress files, and vulnerable components.
If your hosting account includes cPanel or DirectAdmin, look for Imunify360 or ImunifyAV. Its malware scanner can inspect the hosting filesystem, including files outside the directories normally examined by a WordPress plugin. Review scan findings carefully, as automatic cleanup may require confirmation or assistance from your hosting provider.
A clean scan is encouraging, but it is not proof that every backdoor has been removed.
Add Cloudflare WAF Protection
After cleaning the website, place it behind the Cloudflare Web Application Firewall. A WAF filters incoming requests and can block many common attacks before they reach WordPress. Enable the appropriate managed rules, including WordPress-related protections where available, and monitor security events for false positives.
Remember that a firewall helps prevent future attacks; it does not remove an existing infection.
Get Professional WordPress Help
A compromised site can contain hidden files, scheduled tasks, database injections, or stolen credentials. For professional WordPress recovery and protection, contact Illini Web.
For broader cybersecurity and technology support in central Illinois, contact Illini Tech Services at 217-854-6260 or [email protected].