What to do in the first hour after a hack
Maybe a visitor sent you a screenshot of a casino advert on your homepage. Maybe Google shows “This site may be hacked” under your name, or your host has suspended the account. However you found out, the next hour matters more than the rest of the week, because what you do now decides how much of the damage can be undone and how quickly the site comes back.
The instinct is to start deleting things. Don’t, yet. Work through this in order.
Minutes 0–10: stop the harm
- Put the site into maintenance mode, or ask your host to take it offline. If the hack redirects visitors to scam pages or serves malware, every minute it stays up hurts your visitors and your standing with Google.
- Don’t delete anything. Suspicious files, strange users and unfamiliar plugins are evidence. Removing them now destroys the trail that shows how the attacker got in, and if that door stays open, they’ll be back within days.
- Write down what you’ve noticed, and when: the first sign, who reported it, any emails from your host or Google. It feels unnecessary now. It won’t later.
Minutes 10–20: save a copy as it is
Before anyone cleans anything, copy the whole site in its current state: every file, plus a database export. Label it clearly as the infected copy and download it, rather than leaving it on the server.
That copy is what you’ll compare against to find modified files, and it’s your fallback if the clean-up goes wrong. Download the server’s access logs too, because many hosts only keep a few days of them.
wp db export infected-$(date +%F).sql
tar -czf infected-files-$(date +%F).tar.gz public_html/No command-line access? Your host’s backup tool or file manager can do the same job.
Minutes 20–35: lock every door
Assume the attacker knows every password connected to the site, and change them from a computer you trust:
- The hosting control panel
- SFTP and SSH accounts
- The database user, then update
wp-config.phpto match - Every WordPress administrator
- The email accounts on your domain, especially the one that receives password resets
Then sign everyone out by replacing WordPress’s security keys. It invalidates every existing login, including the attacker’s:
wp config shuffle-saltsIf your domain registrar, DNS provider or payment gateway shares a password with any of the above, change those too, and turn on two-factor authentication while you’re there.
Minutes 35–50: find out what changed
Now look, but still don’t remove anything. You’re building a list.
-
New administrators. Attackers often add a user with an innocent-sounding name like
wpsupportoradmin2.wp user list --role=administrator -
Modified WordPress and plugin files. WordPress can compare its files against the official copies. The plugin check only works for plugins from WordPress.org.
wp core verify-checksums wp plugin verify-checksums --all -
Recently changed PHP files, and any PHP file at all inside
wp-content/uploads, which should only ever hold media. Attackers can fake modification dates, so treat this as a starting point.find . -name "*.php" -mtime -14 find wp-content/uploads -name "*.php" -
Scheduled tasks you don’t recognise. Some malware adds one that reinstalls it after a clean-up.
wp cron event listshows them.
Minutes 50–60: tell the people who need to know
- Your host. They may already know, and they can often tell you how the attack arrived.
- Your team, so nobody logs in from an infected computer or restores an old backup without telling anyone.
- Your customers, if personal data could have been exposed. Data protection laws, such as Ghana’s Data Protection Act and the EU’s GDPR, can require you to report a breach, and the GDPR sets a 72-hour deadline. If you’re not sure where you stand, get advice early rather than late.
After the first hour
With the site offline, a copy saved and the doors locked, the clean-up itself can start calmly:
- Replace WordPress, the theme and every plugin with fresh copies from their official sources, rather than trying to scrub infected files one by one.
- Clean the database: injected scripts in posts and settings, spam pages, rogue users.
- Find and fix the way in. It’s usually an outdated plugin, a reused password or a forgotten file anyone could reach.
- Restore from a backup only if you can show it predates the infection, and close the hole first either way.
- If Google flagged the site, request a review from Search Console’s Security issues report once it’s clean.
It’s tempting to restore last week’s backup and move on. But if the attacker got in a month ago, last week’s backup is infected too, and the hole is still open.
What makes the first hour easier
Everything above goes faster when a few things are already in place: off-site backups going back weeks, a list of who has access to what, two-factor authentication on every administrator, and a record of which plugins should be installed. That’s the difference between an afternoon and a lost week.
Close the common holes before anyone finds them: hardening WordPress in an afternoonIf it’s happening right now
Take the site offline, save a copy, change the hosting password, and message us. Our emergency help page lists what to send so we can start straight away. Malware clean-up, the root-cause report and the hardening that follows are all part of our security work.