My WordPress site got hacked: the first 60 minutes checklist
TL;DR: The immediate priority in the first hour is stopping further damage and preserving evidence, not fully diagnosing how the breach happened, which can and should come after. In order: take the site offline or into maintenance mode to stop active exploitation, change every credential with access to the site (WordPress admin, hosting, FTP, database), check for and preserve evidence of what was actually done, and begin restoring from a known-clean backup rather than trying to manually clean an actively compromised site under time pressure.
Why order matters here
Under the stress of discovering a hacked site, the instinct is often to immediately start investigating exactly what happened or trying to manually fix visible symptoms. Both are reasonable eventual goals but the wrong first priority, because an actively compromised site continues doing damage, spreading malware to visitors, sending spam, or providing the attacker continued access, for every minute it remains live and reachable, and manual investigation or cleanup attempted under panic, without first stopping the bleeding, risks missing something and leaving a backdoor in place even after the visible symptom is addressed.
The sequence below prioritizes stopping active harm first, then assessment, then recovery, in that specific order, because reversing this order (investigating first, isolating later) generally results in a longer total incident and a higher chance of an incomplete cleanup.
Minute 0-5: isolate the site
Put the site into maintenance mode or, if you have direct server access, take it offline entirely, rather than leaving a known-compromised site actively serving traffic to visitors while you work. This single action stops the most immediate harm: visitors being served malware, redirected to malicious sites, or having their own data exposed through a compromised checkout or form, and it stops the site from actively being used to send spam or attack other sites if that is part of what the compromise is being used for.
If you have hosting account access, some hosts offer a direct "suspend" or "quarantine" option for exactly this situation, worth checking your hosting control panel for immediately, or contacting your host's support directly if you are unsure how to take the site offline quickly through your specific setup.
Minute 5-15: change every credential
Change the password for every account with any level of access to the site, WordPress admin accounts, your hosting control panel login, FTP/SFTP credentials, database access credentials, and any connected third-party service credentials (payment gateway API keys, email service credentials) that could have been exposed through the compromise. Use genuinely new, strong, unique passwords for each, not variations of what was previously in use, since a compromised system may have had credentials logged or cached by the attacker in a way that a minor variation would not meaningfully protect against.
If the compromise might have exposed your WordPress database (a common target, since it contains user credentials, even if hashed), also consider that WordPress's authentication salts and keys (defined in wp-config.php) can be regenerated as an additional precaution, invalidating any existing session cookies and forcing all users to log in fresh with their new credentials.
Minute 15-30: assess scope without touching too much
Before restoring anything, take a quick inventory of what you can observe, since this evidence is useful both for understanding what happened and, if needed, for reporting to your hosting provider or relevant authorities. Check recently modified files (via FTP or file manager, sorting by modification date) to see what was changed and when, which often reveals the approximate time of compromise and which files were affected. Check for unfamiliar admin user accounts in WordPress, a very common thing attackers create to maintain access even if the original entry point is later closed. Check your hosting account's access logs if available, for unfamiliar IP addresses or unusual access patterns around the time of compromise. And, if you use a security plugin with scanning capabilities, run a scan now for a documented record of what it identifies, even if you plan to restore from backup rather than rely on the scanner's own cleanup feature.
Avoid spending extensive time in deep manual investigation at this stage; the goal here is a reasonably quick inventory, not a complete forensic analysis, since full understanding can come after the site is safely restored and no longer actively at risk.
Minute 30-60: restore from a known-clean backup
Restoring from a backup taken before the compromise occurred is almost always faster and more reliably complete than attempting to manually identify and remove every trace of a compromise, since manual cleanup risks missing a backdoor or malicious file that a full restore to a known-good state eliminates entirely. Identify your most recent backup that predates the estimated compromise time (informed by the file modification dates checked in the previous step), and restore the site's files and database from that point.
After restoring, immediately update WordPress core, all themes, and all plugins to their current versions before bringing the site back online, since the vulnerability that allowed the original compromise, if it was a software vulnerability rather than a credential compromise, is very likely still present in the restored backup's software versions and needs to be patched before the site is exposed to the internet again.
What to do if you don't have a clean backup
If no backup predates the compromise, or backups are unavailable or unreliable, manual cleanup becomes necessary, and this is the point where professional malware removal help, either from your hosting provider's support (many offer this as a service, particularly at higher-tier plans) or a dedicated WordPress security service, is genuinely worth engaging rather than attempting a full manual cleanup alone under time pressure, particularly if you are not deeply familiar with common WordPress malware patterns and how thoroughly they need to be removed to avoid leaving a backdoor in place.
If proceeding manually is unavoidable, compare current files against a fresh, official download of WordPress core and your specific theme/plugin versions to identify unauthorized modifications, check the wp_users and wp_usermeta tables directly in the database for unfamiliar accounts or elevated privileges granted to accounts that should not have them, and check for unfamiliar scheduled tasks (WP-Cron entries) that attackers sometimes use to maintain persistent access even after obvious backdoor files are removed.
After the first hour
Once the site is restored and back online with updated software, the work is not finished, several follow-up actions matter for both security and any legal or business obligations. Set up or verify a reliable, regularly tested backup system going forward if the incident revealed gaps in your existing backup practice. Install and configure a security plugin with active malware scanning and a web application firewall if one was not already in place, or review the configuration of an existing one that may have failed to catch the original compromise. If customer data (personal information, payment details) may have been exposed, review your obligations under applicable regulations, including the DPDP Act's requirements around personal data breaches, covered in general terms in our DPDP compliance guide, and consult with appropriate legal guidance for your specific situation given the potential seriousness of a data exposure. And conduct a more thorough post-incident review, now that the immediate crisis has passed, to understand the likely original entry point (an outdated plugin, a weak password, a vulnerable theme) and address it specifically, rather than assuming the restore and update alone fully close every possible avenue for a repeat compromise.
A priority checklist
| Priority | Action | Timeframe |
|---|---|---|
| 1 | Take the site offline / into maintenance mode | Immediately |
| 2 | Change all credentials (WordPress, hosting, FTP, database) | Within 15 minutes |
| 3 | Inventory modified files, unfamiliar users, access logs | Within 30 minutes |
| 4 | Restore from known-clean backup | Within 60 minutes if possible |
| 5 | Update all software before bringing the site back online | Immediately after restore |
| 6 | Set up/verify backups, security plugin, review entry point | Following days |
FAQs
How do I know for certain my backup is actually "clean" and not also compromised?
Check the backup's timestamp against your file modification date findings from the assessment step; a backup taken clearly before the earliest identified modification date is the safest choice, and if in doubt, choosing an older backup (accepting some lost recent content) over a more recent but uncertain one is the more cautious, safer choice.
Should I notify my hosting provider immediately?
Yes, generally worth doing early in the process, both because your host may be able to assist directly (some offer malware removal support) and because a compromised site can sometimes affect other accounts on shared infrastructure, information your host needs to be aware of promptly regardless of whether you need their direct assistance with cleanup.
Do I need to report this to any authority in India?
Depending on the nature and scale of the breach, particularly if customer personal data was exposed, there may be reporting obligations under the DPDP Act's data breach provisions; this is worth confirming with appropriate legal guidance specific to your situation rather than assuming either that reporting is required or that it is not, given the seriousness and specificity of these obligations.
Can I just delete the suspicious files I find instead of doing a full restore?
This is riskier than a full restore, since manual identification of every compromised file is difficult to do completely, and a backdoor left in place even after obvious symptoms are removed allows the attacker to simply re-compromise the site again; a full restore to a known-clean state, followed by patching, is the more reliable approach when a clean backup is available.
How long should the site stay in maintenance mode during this process?
Until you are confident the restoration is complete, software is fully updated, and credentials have been changed; rushing back online before these steps are genuinely complete risks the same or a similar compromise recurring almost immediately, so it is worth taking the necessary time even if the visible downtime feels uncomfortable.
Will my search rankings be permanently damaged by this?
Not necessarily permanently, but a compromise, particularly one involving malicious redirects or spam content, can trigger a search engine security warning or ranking impact; once cleaned up, you can typically request a review from the relevant search engine (Google Search Console has a specific security issues review request process) to confirm the site is clean and restore normal treatment, though this process itself takes some additional time beyond the initial cleanup.
How do I prevent this from happening again?
Keep WordPress core, themes, and plugins updated promptly, use strong unique passwords and enable two-factor authentication for admin accounts, use a reputable security plugin with active scanning, remove unused plugins and themes rather than leaving them installed and potentially vulnerable, and maintain a genuinely reliable, regularly tested backup system, covered in more detail in our guide on securing wp-admin from brute-force attempts.
Conclusion
The first hour after discovering a hacked WordPress site is about stopping active harm and preserving your ability to fully recover, not about immediately understanding every detail of how the compromise happened. Isolate the site, change every credential with access, take a quick inventory of what happened, and restore from a known-clean backup with software fully updated before bringing the site back online.
If a clean backup is not available, professional malware removal help is genuinely worth the cost compared to an uncertain manual cleanup under time pressure, given how much is at stake in getting this right the first time rather than leaving a backdoor that allows a repeat compromise.
HostCloud's hosting plans include daily backups and malware scanning support, and our team can assist directly with both restoration and cleanup if your site is ever compromised. Plans start at ₹99 a month at https://hostcloud.in.