Hacked WordPress site recovery: what to do, in order
Hacked WordPress site recovery means four things, in order: contain the damage and keep evidence, lock the attacker out, replace infected files and clean the database, then close the hole and monitor. Silent Threads is a WordPress security plugin that helps at each step, with malware, database, persistence and core integrity scanners on every plan.
The first hour
- Back up the hacked site, files and database, and keep the copy off the server. It’s your evidence and your safety net.
- Put the site in maintenance mode so visitors aren’t redirected, and shoppers aren’t skimmed, while you work.
- Change passwords from a clean computer: hosting, SFTP/SSH, database, and every WordPress administrator.
- Remove administrator accounts you don’t recognise, and replace the WordPress salts in
wp-config.phpto end every session. - If the site takes payments, tell your payment provider.
The clean-up
Replace rather than repair: fresh WordPress core, fresh copies of every plugin and theme from their source, no PHP in uploads, and a careful search of the database for injected scripts. Our step-by-step guide, how to remove malware from WordPress, goes through each step with the exact commands.
How Silent Threads helps with hacked WordPress site recovery
| Recovery step | What helps | Plan |
|---|---|---|
| Find what changed | Core File Integrity, Malware Scanner (Quick & Standard), Database Scanner | Every plan |
| Find the way back in | Persistence Scanner (backdoors, rogue tasks), Attack Surface Scanner | Every plan |
| Dig deeper | Deep & Full scans, JS & Card-Skimmer Scanner, Runtime Malware Detection | Pro |
| Keep evidence | Forensic Evidence Bundle (logs, files and differences in one export) | Pro |
| Stop the next attempt | Firewall with 356 built-in rules, brute-force protection, 2FA | Every plan |
| Notice instantly next time | Instant new-administrator alert, weekly security digest | Every plan |
The plugin helps you find, remove and prevent. It isn’t a hands-on clean-up service: if the server itself is compromised, or the infection keeps returning after a full clean-up, involve your host or a specialist who can work on the server directly. Pro and Agency include support tickets, and Agency adds live chat, for help using the plugin during an incident.
Close the hole
A clean site that’s still vulnerable will be hacked again, usually within weeks. Find the entry point (an outdated plugin, a reused password or a compromised hosting account), fix it, then update everything. The WordPress security checklist covers the rest.
After recovery
- If Google flagged the site, request a review in Search Console once it’s clean.
- Watch closely for a month: new administrators, changed core files and unexpected outbound connections are the signs of a surviving backdoor.
- Keep dated backups so you have a known-clean point to compare against.
Not sure it was a hack? Start with the signs of a hacked WordPress site.
Frequently asked questions
How long does hacked WordPress site recovery take?
For a typical small site, a few hours once you have hosting, SFTP and database access. Sites with many plugins, custom code or a recurring infection take longer.
Do I lose my content when recovering a hacked site?
Not if you work carefully. Posts and pages live in the database, which you clean rather than replace, and you keep a full backup of the hacked site before changing anything.
Related reading
Start with a 30-day trial
Every new license starts with a 30-day trial with every premium feature included.