My WordPress site has been hacked: what now?

The first hour

First, because you probably need to hear it: the site is almost certainly recoverable. A hack caught early is usually back and behaving by the end of the week. If you do nothing else today, do these four things.

1. Copy the site as it stands, files and database, and put it somewhere off the server. Yes, it is infected. It is also the only record of what happened, and it holds everything you have published since your last clean backup.
2. Change the passwords on your hosting control panel, every WordPress administrator, FTP or SFTP, and the database user. Change the password on the email address those accounts reset to as well. That mailbox is often the real front door.
3. Tell your host. If they are worth paying, this is their problem too, and they can read things in the server logs you cannot see.
4. Write down when you noticed and what you saw. If the site holds customer records or takes payments, speak to whoever handles data protection the same day. Under UK GDPR, some personal data breaches must be reported to the ICO within 72 hours; our guide to GDPR and web hosting covers the basics.

Then stop. Resist the urge to start deleting files to see whether it helps.

Things that make it worse

• Deleting folders at random. You break the site without removing the backdoor, and nobody can tell afterwards what was infected and what was snapped off in a panic.
• Restoring last night's backup and calling it finished. If the hole is still open, and it usually is, you have restored the hole along with the site.
• Installing four security plugins at once. They argue with each other, and they are scanning a site that is already compromised. It is fitting a lock after the burglar has moved in.
• Shrugging it off because it looks harmless. Hidden spam links, and redirects that only fire for phone visitors arriving from Google, are the most common thing we see. They get you flagged in browsers and on mail blocklists long before you spot them.
• Paying whoever emails demanding money. That message went to thousands of addresses from a script that has never looked at your website.

How they got in

It is rarely clever. In twenty years of running servers we have seen the same short list again and again:

• an out-of-date plugin with a publicly known flaw, found by scripts within hours of the details being published;
• a plugin or theme its author abandoned, so the flaw stays open as long as it stays installed;
• weak or reused administrator passwords, found by scripts that try logins all day;
• an old admin account belonging to a developer or member of staff who left years ago;
• a forgotten copy of the site in a subfolder such as /old/ or /dev/, running an ancient WordPress on the same hosting account.

Very little of that is about the server. A well-run server will still hand over a site through a contact form plugin nobody patched. It works the other way too: on a badly run shared server, a break-in on somebody else's site can walk across to yours.

What a proper clean-up involves

Worth knowing whether you do it yourself or pay somebody, so you can tell a clean-up from a quick tidy.

1. Put the site behind a holding page. Working on a live compromised site is how people get reinfected halfway through.
2. Replace rather than repair. WordPress core, plugins and themes are swapped for fresh copies from source.
3. Check what cannot be swapped: the uploads folder, mu-plugins, wp-config.php and .htaccess files. An uploads folder holds pictures, so a PHP file in there is a red flag every time.
4. Clean the database: injected scripts in posts, junk in the options table, administrator accounts you never created, and scheduled tasks set up to reinstall the malware next week.
5. Hunt the backdoor. A site cleaned and reinfected three days later was never clean.
6. Rotate the security keys in wp-config.php, which logs every session out, update everything, and only then put the site back in front of the public.

Getting your reputation back

Cleaning the site is half the work. The other half is telling everyone else. In Google Search Console, look under Security Issues and request a review once the site is genuinely clean; requesting early and failing puts you further back. Browser warnings clear once the review passes. If the server was used to send spam, mail from your domain may be blocked, and sorting the server's standing with mail providers falls to your host, so ask them directly. Our sister site explains why emails go to spam. Then watch the enquiries: plenty of people fix a site and keep wondering why the phone stayed quiet. A hacked shop is heavier again, with order data and payment trust involved; see our WooCommerce hosting page.

Stopping it happening again

Repeat hacks nearly always trace back to the same gaps. Updates need a schedule a named person owns, not "when I remember". Backups need to live away from the server and go back far enough: a few days of history is no use when the break-in happened weeks before anyone noticed (more in website backups explained). Keep fewer plugins, since each is a stranger's code with full access to your database. Keep two or three administrators rather than eleven, and remove accounts the week somebody leaves. Block the obvious attacks at the server so they never reach WordPress, and make sure somebody is actually watching.

That list is more or less the job description for managed hosting. On our WordPress hosting, at £1 a day + VAT, we do the updates, keep daily off-site backups for 14 days and monitor the servers around the clock. If a site we host is hit, clearing it up is part of what you already pay. Out of hours it is usually Olly, our director, reading the alert. Ring 01623 650333 and tell us what you are looking at.

Related