WordPress website hacked checklist

🔒 Immediate Actions

• Take the site offline or enable maintenance mode to stop further damage and prevent indexation.

• Create a full backup of files and database for forensic analysis and recovery.

• Change all passwords immediately (WordPress, database, hosting panel, FTP, SSH, email, API keys).

• Notify your hosting provider to check for server-level compromises or logs.

• Delete suspicious admin users that were not created by you.

• Disable file editing in WordPress by adding constants in wp-config.php.

• Regenerate WordPress salts and keys to invalidate existing sessions and tokens.

---

🔍 Investigation

• Review access and error logs for suspicious POST requests, login attempts, and file uploads.

• Scan all files for recent changes using file modification times.

• Verify core, plugin, and theme checksums with WP-CLI or security tools.

• Search for typical malware patterns like eval, base64_decode, gzinflate, etc.

• Scan the database for injections and scripts using queries to detect <script>, eval(), or base64.

• Check for PHP files above the public_html root which may indicate hidden backdoors.

• Check plugins for known vulnerabilities using WPScan or Patchstack vulnerability databases.

• Look for unauthorized users in the database (e.g. extra admin accounts).

• Scan the wp_options and wp_posts tables for malicious payloads or redirects.

• Check scheduled cron jobs both via WordPress (wp cron event list) and OS-level (crontab -l).

• Review .htaccess and server config files for hidden redirects or allow rules.

• Verify file permissions and ownerships (typically 644 for files, 755 for folders).

• Check for hidden elements via CSS that may hide malicious links or code.

• Inspect the frontend source code for injected or obfuscated JavaScript.

• Clear all site-level and server-level caches to avoid serving cached infected code.

---

🧹 Cleanup

• Manually remove malware, web shells, and backdoors found during investigation.

• Delete unused or suspicious plugins and themes completely from the server.

• Reinstall WordPress core using official source (e.g. wp core download --force).

• Reinstall all plugins and themes from trusted sources (no nulled versions).

• Manually clean infected database entries in posts, options, or user meta tables.

• Reset all user passwords especially for administrators and editors.

• Run a malware scan with multiple tools like Wordfence, Sucuri, or MalCare.

• Install a real-time activity logger (e.g. WP Activity Log) to track background actions.

• Disable or remove suspicious cron jobs identified during investigation.

---

🛠️ Recovery & Relaunch

• Thoroughly test on staging to ensure no malware or broken functionality remains.

• Change all credentials again post-cleanup to invalidate any stolen data.

• Activate a premium Web Application Firewall (WAF) like Cloudflare, Sucuri, or Wordfence.

• Push the cleaned site live only when confirmed safe and secure.

• Check Google Search Console for warnings or blacklisting and request a review if needed.

• Test SEO, sitemap, redirects, and analytics to ensure nothing was tampered with.

---

🛡️ Hardening & Prevention

• Enable Two-Factor Authentication (2FA) for all admin accounts.

• Deploy a WAF (Web Application Firewall) to block malicious traffic.

• Restrict access to wp-admin and wp-login via IP whitelisting or HTTP auth.

• Remove all inactive plugins and themes as they still pose risks.

• Configure auto-updates or update schedules for core, plugins, and themes.

• Set up automated backups with offsite storage and test restore functionality regularly.

• Lock down file and folder permissions and use proper ownership settings.

• Disable XML-RPC if not in use to reduce brute force and DDoS attack vectors.

• Block PHP execution in upload folders via .htaccess or server config.

• Set up monitoring alerts for file changes, logins, and traffic spikes.

• Keep activity logger enabled long-term for post-incident visibility.

• Review and rotate API keys regularly (payment, SMTP, analytics, etc.).

---

⚖️ Compliance & Legal (if applicable)

• Assess whether a data breach occurred involving personal user data.

• Report the breach to authorities if required under GDPR or local laws.

• Notify affected users transparently with recommended actions and status.