Recover a compromised WordPress website

Contain the incident

1. Put the website into maintenance mode or restrict access if it is redirecting visitors, sending spam or exposing data.
2. Do not delete all suspicious files before preserving logs and identifying the likely compromise time.
3. Change Dprime, WordPress, SFTP, SSH, database and relevant third-party credentials from a clean device.
4. Revoke unknown WordPress administrators, sessions, application passwords and API tokens.

Recover clean application files

1. Choose a backup from before the earliest confirmed compromise.
2. Restore or rebuild WordPress core, plugins and themes from trusted sources.
3. Inspect uploads and custom code because restoring only core files can leave malicious content behind.
4. Update WordPress, plugins and themes before returning the site to public access.
5. Scan the recovered site and monitor logs for repeated access to the original malicious path.

Reduce the chance of recurrence

• Remove abandoned plugins and themes rather than merely deactivating them.
• Use unique passwords and two-factor authentication where available.
• Limit administrator accounts and restrict WordPress administration by IP when practical.
• Keep automatic security updates enabled and review failed updates.
• Use a care or malware-protection service when the site needs active monitoring and recovery support.