Hacked WordPress site: what to do

First thing: don't touch anything

Seems obvious but it isn't. The first reaction is to open files, modify configurations, delete suspicious plugins. Stop. Take a screenshot of the homepage, a backup of the files and database as they are now. Even if they're infected. You'll need it to understand what they changed and, if necessary, to do a clean restore. If you don't know how to do a backup, use a plugin like UpdraftPlus or download the database from phpMyAdmin. Then block access to the site with .htaccess or put it in maintenance mode until you figure out what to do.

How to tell if WordPress is really hacked

If you see any of these signs, the site is compromised. There's no 'maybe'. You need to intervene. The clear signs:

• The homepage shows content in Chinese or Russian.
• Links to phishing sites appear.
• WordPress has administrator users you didn't create.
• The site redirects to external domains.
• Plugins you don't recognise are installed.

Less obvious signs, still worth taking seriously

Easier to write off as 'technical glitches', but they deserve the same attention as the ones above:

• Sudden slowness.
• Pages loading strange content from the database.
• Spam emails sent from your domain.
• Google flagging your site as compromised.

The first 24 hours: what to do

In order, three things to do — and one to know when to stop.

• Change all passwords: WordPress admin, database, FTP, admin account email, hosting panel. Long, different passwords for each account.
• Check WordPress users: delete any you didn't create, especially those with administrator role.
• Check theme and plugin files: look for base64_decode, eval, file_get_contents from external URLs, strange .php files in wp-content/uploads.
• If you don't know what to look for, stop here and call someone who does this for a living: a mistake at this stage can make things worse.

Cleaning the site: two approaches

Either way, verify the site is clean before reopening it: Google checks, and if it comes back online infected, they penalise you.

• Restore from a clean backup: if you have a backup from before the hack, restore that, update WordPress and plugins to the latest version, change all credentials and add more security. Faster and safer.
• Manual cleanup: go file by file, compare with original plugin versions, remove infected files, clean the database of suspicious records and hidden redirects. Needed when there's no backup or it's old.

How to prevent it happening again

WordPress is the most attacked CMS in the world. Not because it's insecure by design, but because it's the most widespread and there are more bots trying to exploit it. Things that actually work:

• Never use 'admin' as a username.
• Disable XML-RPC access if you don't use it.
• Rate limit wp-login.php.
• Use HTTPS with forced redirect.
• Update WordPress and plugins within a week of release.
• Don't install plugins from unknown sources.

Things that don't really help

WordPress security is constant maintenance, not a product to buy — and these three, on their own, aren't enough:

• An 'all-in-one' security plugin that isn't configured properly.
• A CDN, if you have no other problem beyond DDoS.
• An application firewall, if the plugins are already vulnerable.

How much does it cost to recover a hacked WordPress

It depends on how bad it is and how long it went unnoticed. In economic terms: from €70 to €420 if a freelancer does it at their hourly rate, from €300 to €3,000 if an agency sells you an 'emergency recovery package'. The real difference is how clean the job is, not the price.

• A few infected files, restored from a recent backup: 2-4 hours of work.
• Backdoors scattered throughout the code, compromised database, hidden redirects: 6-12 hours.
• No backup, hackers who modified months of content: might need rebuilding.