HF PanelDocsv1.0.0

Restore a hacked WordPress site

Find the infected files, restore a clean backup, update and harden WordPress, and change every password and key so the attacker can't return.

Signs of a hacked WordPress site: visitors are sent to strange sites, new admin users appear, Google warns about the site, your host reports malware, or the account suddenly sends spam. This tutorial cleans the site and closes the way back in. Work through it in order and don't skip the passwords at the end.

You need: the Control Panel login of the account. Allow about an hour.

1. Put the site in maintenance mode

  1. Open Control Panel › Websites › WordPress and choose the site.
  2. Under Switches, turn on Maintenance mode.

Visitors see "briefly unavailable" instead of the hacked pages while you work.

2. Scan and quarantine

  1. Open Security › Security scan and click Scan my websites. The scan runs in the background.
  2. When the Findings table fills in, click Quarantine on each file. Quarantined files stop running, and you can Put back a false alarm later.

See Security scan.

3. Find changed WordPress files

  1. Back on Websites › WordPress, under Security, click Check now on Check for changed files.
  2. It lists WordPress and plugin files that differ from the official copies: these are injected or replaced files.

4. Find when it started

Open Account › Activity log and filter by Sign-ins and Changes. Look for sign-ins from addresses you don't know and changes you didn't make. Note the date: you want a backup from before it.

5. Restore a clean backup

If you have a backup from before the hack:

  1. Open Files › Backups.
  2. Click Restore next to a backup made before the date from step 4.
  3. In What to restore, choose Everything, or Website files only if the database is fine.
  4. Type RESTORE and click Restore.

Note: files added since the backup are kept. Run the scan again afterwards and quarantine anything it still finds. To restore only certain files or folders, use Restore › Restore one file, database or mailbox….

If you have no clean backup, delete the files found in steps 2 and 3 instead, and use Update everything in step 6 to put back clean WordPress files.

6. Update everything

On Websites › WordPress:

  1. Click Update everything. WordPress, every plugin, every theme and the translations are updated.
  2. In the Updates card, deal with every plugin marked Known vulnerability: update now, or deactivate and delete it if there is no fix yet.
  3. In WordPress admin, delete every plugin and theme you don't use, and every user you don't recognise.

7. Harden the site

  1. In Security hardening, click Fix all.
  2. If No administrator is called "admin" fails, make a new administrator with your own name in WordPress admin, sign in as it, then delete the old one.

8. Change every password and key

An attacker may have copied passwords, so change them all:

  1. In Security hardening, click Refresh keys. Everyone, including any attacker with a stolen login cookie, is signed out of WordPress.
  2. Under Security › Admin password, set a new password for each administrator.
  3. On Databases › MySQL databases › Users & privileges, set a new password for the site's database user, then put it in wp-config.php with Files › File Manager.
  4. Change your Control Panel password and turn on two-factor login under Account › Password & security.
  5. Change the passwords of FTP logins (Files › FTP accounts) and mailboxes that may have been exposed.

9. Bring the site back

  1. Turn Maintenance mode off on Websites › WordPress.
  2. Run Scan my websites once more. Open findings should be 0.
  3. If Google flagged the site, ask it for a review in its site owner tools.

10. Stop it happening again

  • Turn on Plugins update themselves and keep WordPress updates itself on.
  • Make sure nightly backups run: check Files › Backups, or set Your backup schedule if your plan includes it.
  • Use staging to try big updates.