Hacked WordPress site: what I do in the first hours

What I do in the first hours on a hacked WordPress site

The steps are similar on every hacked site, and the solution is always tailored to that page, so a future attack is harder. In emergencies I act in less than an hour, as long as it is within 9 AM to 9 PM ET. An infection or malware counts as an emergency.

1. Step 1

   Put the site in maintenance mode

   The first thing I do is pause the visits the site is receiving, so people do not see the infection or get sent to strange pages. See WordPress maintenance mode for how that pause works.

2. Step 2

   Diagnose the cause immediately

   I scan the site right away to see whether WordPress core was compromised, whether extra files were injected, or whether a plugin is causing the infection or bringing in the problems.

3. Step 3

   Check core file hashes and run an anti-malware scan

   I verify the hashes of every WordPress core file, and I run a scan with an anti-malware tool.

4. Step 4

   Inspect the server, above WordPress

   I go to the server itself and look for backdoors and hidden cron jobs that are causing problems. That is a layer above WordPress. The point is to be sure the infection does not come back, even if it already looks removed at the WordPress level.

5. Step 5

   Harden permissions and reset credentials

   I do not only reset or restore file permissions. I tighten them, with strict read and write permissions, so a future hack is much harder. I also reset credentials: every WordPress user password, and the server users and passwords. I review which users exist and confirm with the client which ones are real and which ones they do not recognize.

6. Step 6

   Add protection that fits that site

   In some cases I install a tool such as Wordfence or a WAF, or something that limits login attempts. If the website only serves visitors from one country, or from a specific list of countries, I can block visitors from the other countries that are not relevant. I always look at what else that particular site needs, to prevent further damage.

On sites I already maintain, I jump in and start the cleanup first, then I notify the agency. The agency decides whether to tell the end client. You get a report of what happened and why. If I am only auditing and I do not work together yet, I do notify you directly. Details of that notice are also on the white-label WordPress maintenance page.

Why I also check the server, not only WordPress

Cheap automated maintenance plans, in the $39 to $99 range, usually only cover the WordPress layer. They apply updates automatically. At that price there is not really a human looking at what is going on, and many things slip through.

• Server-level backdoors

  I have found backdoors at the server level, a layer above WordPress. Those cheap plans would not normally detect them, because they are only checking the lower layer, at the CMS.

• Cron jobs outside WordPress

  I have also found cron jobs that are not in WordPress at all, and that run malicious code.

That is why the cleanup is not finished when the WordPress files look clean. I also check the server, so the infection does not reappear. The WordPress security checklist covers the layers I keep in place after a cleanup. Fix WordPress is the broader repair service when the problem is not only an infection.

A real estate listings site I rescued more than once

I have rescued a real estate listings site with thousands of pages from malware or hacks more than once. I am not naming the site here.

I first rescued it from a hack on the old shared host, then moved it to a new cloud server. About a year later there was a second incident: redirects to external sites, so a page would open and then go to another external page; injected files; cron jobs on the server; and an altered WordPress core.

The same site also had a serious speed problem, which I fixed at the server level. The full case, including the load times, is in Work I can show on the home page. The server-level cache work is on the WordPress speed optimization page.

Is cleanup included in a care plan?

When a site arrives already hacked, the cleanup is included in the plan: the $250 basic plan and the $500 full plan for ordinary sites, and the $500 or $1,000 WooCommerce packages for stores. I do not offer the $250 plan for WooCommerce stores, because a store is too critical to the business. Without a plan, cleanup is $149 per urgent issue.