When you find out a WordPress site has been compromised, the temptation is to do everything at once. Delete the bad files, change all the passwords, run a scanner, restore from a backup, call the host. Done in the wrong order, these actions can destroy the evidence you need to find the entry point, leave the attacker still on the server, and make the recovery harder than it needed to be. This article describes the order of operations we follow in the first 24 hours after a confirmed WordPress compromise.
Hour 0: Confirm the compromise
Before triggering an emergency response, make sure there is actually a compromise. Some symptoms have benign explanations. A new admin user might be a colleague who forgot to mention it. A modified theme file might be a developer’s pending change. A warning in a security plugin might be a false positive.
Check the strongest signals first. Files in the document root that should not be there. Indexed URLs in Search Console that match nothing on your site. Modified WordPress core files. Outbound connections to suspicious destinations. Browser warnings on the URL. Any one of these confirmed, you have an incident.
Hour 1: Take a forensic snapshot
This is the step most people skip and most often regret later. Before you change anything, take a full backup of the current compromised state. Files, database, the lot. Store it off site somewhere that will not be touched. This is your forensic snapshot. Without it, you will not be able to trace how the attacker got in, and without that, the same attack will recur.
The snapshot is not for restoration. It is for analysis. Keep it separate from your clean backups.
Hour 2: Communicate, but not publicly yet
Tell the people who need to know. Your hosting provider’s security team, especially if they handle shared infrastructure. Your developer or agency. Internally, anyone who has admin access. Customers and the public can wait until you have facts and a clear remediation underway. Public communication during the chaos phase tends to be wrong and creates more work than it solves.
Hour 3: Contain the damage
Stop the bleeding without erasing the evidence. If the attacker has visibly defaced pages or is serving malware, take the site offline temporarily. Most hosts have a maintenance mode or a coming soon page that can be enabled in seconds. This protects visitors without overwriting any files.
If specific pages are compromised but the rest of the site is functional, you can route around them with redirects or temporary blocks at the host level. Avoid editing files unless you have to.
Hour 4 to 6: Rotate everything
Assume every credential the attacker could have touched is compromised. Change them all. WordPress administrator passwords. The hosting control panel password. SFTP and SSH credentials. The database password, then update wp-config.php with the new value through the host’s console rather than over the live site. Any API keys stored in plugins for email, payment, analytics, or other services. The WordPress salts and keys in wp-config.php.
Rotating salts and keys invalidates every existing WordPress session, which forces both you and any attacker out. This is essential. Without it, an attacker who captured a session cookie may retain access even after every password is changed.
Hour 6 to 12: Identify the entry point
Now use the forensic snapshot to figure out how the attacker got in. Look at recent file changes in the document root. Look at hosting access logs for unusual POST requests to wp-admin/admin-ajax.php, wp-login.php, xmlrpc.php, or plugin specific endpoints. Look at the plugin list for anything with a known vulnerability for the installed version.
In the Sydney case study we have referenced in earlier articles, the entry point was almost certainly an outdated file manager plugin with a long history of remote code execution vulnerabilities. Identifying that was the difference between fixing the symptom and fixing the cause.
Without finding the entry point, the attacker will be back within days, often hours.
Hour 12 to 18: Clean up systematically
With the entry point known and the forensic snapshot preserved, begin the cleanup. Remove every malicious file. Compare WordPress core files against the official versions and replace anything modified. Check themes and plugins similarly. Audit users and remove any unknown accounts. Review post content for injected links or scripts. Examine the database for known malware option keys and suspicious entries in wp_options.
Some compromises are extensive enough that the right answer is to restore from a clean pre incident backup and reapply only verified content changes since. Others are confined enough that surgical cleanup is faster.
Hour 18 to 24: Close the door
Patch the vulnerability that let the attacker in. If it was an outdated plugin, update or remove it. If it was a weak password, the rotation has already addressed that, but turn on 2FA so it cannot happen again. If it was a stolen session cookie, you have already rotated keys and salts. If it was a phishing email that captured an admin login, train the team and audit the login activity for any other compromised accounts.
Apply additional hardening that would have prevented the attack. Block PHP execution in uploads. Restrict access to xmlrpc.php. Enable login attempt limits and 2FA across every administrator account. Move to a security plugin that monitors for new files in unexpected locations.
The next 48 hours
Once the site is clean, the work is not finished. Run a fresh malware scan with at least two reputable tools to cross check. Submit a reconsideration request in Google Search Console if a manual action has been applied. Communicate with customers if any data was potentially exposed. Document what happened, the timeline, the entry point, and the changes made. The document is for your team and for any future audit.
Need a hand?
If your WordPress site is currently compromised or you suspect it might be, Smart Coding offers emergency incident response. Get in touch immediately and we will walk you through the steps above in real time. The earlier the response, the smaller the damage.
