This is a 24-hour playbook: go offline, preserve evidence, find how they entered, decide clean vs restore, then harden before traffic returns.
hour 0-2: contain and snapshot
Enable maintenance mode or take the site offline at the hosting or CDN layer. Snapshot files and database before you delete anything. Download access logs for the past 14 days. Note when you first saw spam pages, redirects, or Google Safe Browsing warnings.
Change hosting panel, FTP, database, and WordPress admin passwords from a clean device. Assume the attacker had credential access if admin users you do not recognize exist.
If backups are old or uncertain, manual clean plus 7 to 14 days monitoring is required.
hour 2-8: scan and compare files
Run Wordfence or Sucuri scan from a known clean admin account. Compare wp-admin, wp-includes, and index.php against a fresh WordPress download of the same version. Diff shows modified core files. Inspect uploads for PHP files, inspect .htaccess for redirect rules, and search the database for eval(base64_decode patterns in options and posts.
| Indicator | Common meaning | Action |
|---|---|---|
| Unknown admin users | Backdoor account | Delete after backup, audit user_meta |
| PHP in uploads | Webshell | Remove file, block PHP execution in uploads |
| Redirects in .htaccess | SEO spam | Restore clean htaccess, find injection source |
| Recently modified plugins | Supply chain or nulled plugin | Reinstall from official source |
clean vs restore from backup
If you have a backup from before infection (verified by scan on a staging copy), restore is faster and safer than manual surgery. If backups are old or uncertain, manual clean plus 7 to 14 days monitoring is required. Never restore a backup without patching the entry point first or you reinfect immediately.
Site compromised right now?
Talk to us →hour 8-24: harden before relaunch
Update WordPress core, themes, and all plugins. Remove unused plugins entirely. Enable two-factor authentication for all admins. Add WAF rules at hosting or Cloudflare. Disable file editing in wp-config: define(‘DISALLOW_FILE_EDIT’, true); Review file permissions: directories 755, files 644 typically.
after relaunch
Request Google Search Console security review if you were blacklisted. Monitor logs for returning attacker IPs. Schedule weekly integrity scans for 30 days. Move to ongoing maintenance if you do not have internal capacity to patch within 48 hours of security releases.
what this looks like when we do it
Emergency breach response is typically 8 to 24 hours for containment and initial clean, plus 3 to 7 days for monitoring on complex sites. We deliver a short incident report: entry vector, files affected, credentials rotated, and hardening checklist completed.
For active incidents, use emergency website support with hosting access ready. Prevention work continues under managed maintenance so patches do not wait for the next breach.
After a hack, restore trust with evidence: clean scan, closed entry point, rotated secrets, and monitoring before you announce all-clear.
