WordPress hacked.
What incident response actually looks like on a compromised WordPress site. Confirming the compromise, containing its spread, cleaning the install, hardening the rebuild, and telling the right people in the right order. We write from procedures we have run on real client sites under real deadline pressure.
What this desk covers.
Six beats from the moment a compromise is confirmed to the moment the site comes back online hardened. The sequence matters. Running cleanup before containment is how infections end up in the backups too.
Confirmation
Is this actually a compromise or is it a blocklist artifact, a caching oddity, or an SEO spammer hotlinking from elsewhere. Signals that warrant incident response versus signals that warrant a support ticket.
Containment
Isolating the compromised install before cleanup starts. Credential rotation, locking the admin surface from external access, snapshotting the compromised state for forensics, freezing backups before they get poisoned.
Forensics
Reading access logs, database timestamps, file modification history, and admin audit trails to understand entry point and persistence mechanism. Skip this and the cleanup closes the wrong door.
Cleanup
Removing malware from core files, theme files, plugin files, the database, and the .htaccess layer. Scanner tools, manual review, and the checklist we use when scanners disagree with each other.
Hardening the rebuild
The site comes back with the vulnerability closed, not just the malware removed. Patched software, rotated secrets, tightened file permissions, and the audit that confirms the attacker is actually out.
Communication
Users, hosts, payment processors, Google Search Console, and in regulated sectors, affected data subjects. What to say, when, and what legal disclosure you may owe.
Pieces from this desk.
WordPress malware removal: the procedure we run on client sites
Identify, clean, close the door, verify. The reactive procedure that runs after the hardening layer did not hold.
How to fix a hacked WordPress site: the first-hour playbook
The decisions that come before the cleanup. Evidence preservation, five containment moves, three realistic routes out, and the communication sequence that keeps the site running afterwards.
The WordPress pharma hack: cleanup, then the real work
The cloaking mechanism in three lines. The cleanup procedure. The SEO recovery arc: 410 headers, URL removals, recrawl requests, and the four-to-eight-week wait to get your rankings back.
Before and after the incident.
Incident response is the middle third of a WordPress security posture. What comes before is hardening. What follows is ongoing monitoring, which often means picking tools.
WordPress hardening: closing the attack surface before the attack arrives
The editorial position that most WordPress compromises are preventable at the configuration layer. Six beats of hardening work that makes incidents rarer.
Best WordPress security plugins, adjusted for reality
Five plugins we evaluate for the jobs that matter after an incident: ongoing malware detection, integrity monitoring, and cleanup automation.