Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRestoring a hacked WordPress site is safest when you treat it as both a recovery and an investigation. A clean backup can return the site to an earlier state, but it does not automatically remove the weakness that let the attacker in. Preserve evidence, verify that the backup contains both the site files and its separate database, restore the files before importing the database, then update credentials, invalidate existing sessions, update WordPress and investigate the original entry point.
Contact your hosting provider before changing anything if the site is on shared infrastructure, if the host suspended it, or if you cannot prove what the backup contains. The host may have affected neighboring services, server-level logs or additional snapshots that are not visible in the WordPress dashboard.
As an Amazon Associate I earn from qualifying purchases.
1. Contain the incident before restoring anything
Do not immediately overwrite the compromised installation. First create a record of what happened and preserve a copy of the current state. WordPress.org’s FAQ My site was hacked, last updated July 26, 2026, says: “The first actionable step you should take post-compromise is documentation.” That record helps you choose a backup, explain the incident to the host and recover if the first restore fails.
Recommended Free Tools
Record symptoms and timing
- Write down when the problem was first noticed, including the time zone.
- Describe visible changes such as unfamiliar pages, redirects, altered content, new administrator accounts or unexpected pop-ups.
- Record browser or search-engine malware warnings, blacklisting notices and any host suspension message.
- List recent WordPress, plugin or theme installations and updates, including approximate dates.
- Note the domain, hosting company, server type if known, and every person or service that can administer the site.
Do not delete suspicious users, files or database rows merely to make the site look normal. Those items may show how the compromise happened. If the site must be taken offline, ask the host to do so or follow its documented emergency procedure rather than guessing at server controls.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Ask the host what else may be affected
Tell the host that the WordPress installation is compromised and ask whether the account is shared with other sites, databases, scheduled jobs or control-panel services. Request a list of available backups and their timestamps, the time zone used for those timestamps, and any server-level security findings. A WordPress-only cleanup may be incomplete if the attacker reached the hosting account or another application.
Preserve a pre-remediation snapshot
Before cleaning or restoring, ask the host or your administrator to make a snapshot of the current files and database. WordPress.org recommends keeping this additional snapshot even when the environment is infected. It can be used for reference, comparison or forensic work if recovery fails. Store it separately from the clean backup and label it clearly as compromised so it is not accidentally restored later.
2. Prove that the backup is complete and clean enough to use
A download of the web directory alone is not a complete WordPress backup. A typical restore requires two related components:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Files: WordPress core files, the
wp-contentdirectory containing themes, plugins and uploads,wp-config.php, and server configuration such as.htaccesswhen the site uses it. - Database: A separate MySQL or MariaDB export containing posts, pages, settings, users, plugin data and other site records.
Use the same backup set for both components whenever possible. Files from one date and a database from another can produce missing media, broken plugin settings or a site that appears to roll back only partially.
Backup acceptance checklist
| Question | What to verify | Why it matters |
|---|---|---|
| Does it contain files? | Core files, wp-content, uploads, themes, plugins, wp-config.php and any required .htaccess. |
Without the files, the database has nothing to run on and media may be missing. |
| Does it contain a database export? | A readable MySQL or MariaDB export, or a host-managed database snapshot. | Posts, pages, settings and accounts are generally stored separately from files. |
| Does it predate the compromise? | Compare the backup timestamp with the first known suspicious activity, using the same time zone. | A backup created after intrusion may preserve the attacker’s code or account. |
| Do both parts belong together? | Confirm the files and database came from the same backup job or matching restore point. | Mismatched versions can cause missing content or plugin errors. |
| Is there an independent copy? | Keep another copy on a separate storage location, such as a local computer or external drive. | A single copy can be lost, overwritten or corrupted during recovery. |
| Can the host validate it? | Ask whether the provider can inspect, mount or test the archive without putting it online. | The host may know format-specific requirements that are not visible in the archive. |
Do not call a backup clean solely because its date looks old. Compare the date with the incident timeline and, where possible, have the host or a qualified WordPress incident responder inspect it. If no backup clearly predates the compromise, stop and get help rather than restoring an uncertain copy over the only remaining evidence.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
3. Prepare a controlled restore
Host panels and backup products use different labels and workflows. The steps below describe the usual sequence documented by WordPress Developer Resources, but the exact buttons, import limits and maintenance controls depend on your host.
Gather the information you will need
- The verified files archive and matching database export.
- The database name, username, password and server name expected by the restored site.
- Access to the hosting control panel, file manager or secure file-transfer method, and database import tool.
- A copy of the current
wp-config.phpand any host-specific settings, kept with the preserved incident snapshot rather than mixed into the clean files. - The domain’s normal PHP, web-server and database requirements, if your host documents them.
Keep the clean archive offline until the host confirms where it should be uploaded. Do not unpack an unverified archive directly over a live, compromised directory.
Decide whether the restored software version is compatible
WordPress.org cautions that reinstalling a different software version can break a site. Compare the WordPress core, plugin and theme versions represented by the backup with the versions supported by the hosting environment. If the host requires a particular PHP or database version, ask for guidance before the import. Do not “fix” a version mismatch by mixing arbitrary files from the hacked installation into the clean copy; that can reintroduce the compromise.
4. Restore the WordPress files first
The typical order is files first and database second. This gives the database a matching WordPress codebase when the site starts and lets you replace the compromised executable code before loading its content and settings.
- Use the host’s documented restore, file-manager or secure-transfer interface to place the verified files in the correct document root. If the host offers a full restore point, select the matching point for both files and database rather than restoring unrelated components.
- Replace the WordPress core and the
wp-contentcontents with the clean versions from the backup. Include uploads and any required configuration files. Do not copy unknown PHP files, modified plugins or themes from the compromised directory merely because they are newer. - Check that the restored directory has the ownership and permissions expected by the host. Use the provider’s documented settings; permissions that are too restrictive can stop WordPress from reading files, while permissive settings can create another security problem.
- Open the restored
wp-config.phpand compare its database name, user, password and host values with the credentials currently provided by the host. If the credentials changed during containment, update the file to match the new values. Keep the file private and do not paste its contents into support tickets or public forums. - Do not launch a normal cleanup by deleting files from the compromised directory after the clean files are in place. Preserve the old directory in the incident snapshot and verify that the web server is actually pointing at the restored document root.
If the host uses a one-click restore, its interface may combine these operations or perform them in a different order. Ask support to confirm what the operation replaces before approving it.
Rank #3
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
5. Import the matching database
- Open the host’s database-management or backup-restore tool and select the database assigned to the restored site. Confirm the database name before importing; choosing another application’s database can cause data loss.
- Use the import function specified by the host for the MySQL or MariaDB export. Large files may require a host-side restore instead of a browser upload because web interfaces impose size and time limits.
- Wait for the host to report completion. An upload that finishes in a browser is not proof that every table imported successfully.
- Confirm that the database user named in
wp-config.phphas access to the restored database. If the host created a new database or user, update the configuration with those exact credentials. - Load the site using the normal domain and check whether WordPress reaches the expected login or maintenance screen. If it shows a database-connection error, stop repeated imports and recheck the database name, host, username and password with the provider.
Do not import a second, uncertain database over the first one while troubleshooting. Preserve the failed result, record the error and ask the host whether the export is complete, compatible and intended for that file set.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match6. Check the restored site before declaring success
Validation should cover both public pages and administrative functions. A site that displays a homepage can still have missing media, broken rewrites or unauthorized accounts.
| Area | Checks | Failure clues |
|---|---|---|
| Front end | Open the homepage, several older posts or pages, category archives, contact forms and any important landing pages. | Redirects, malware warnings, blank pages, injected links or missing content. |
| Media | Open images and downloads from different dates, not only the newest upload. | Broken URLs or missing files indicate an incomplete uploads restore or mismatched database. |
| Administration | Sign in with a known account, review the user list and inspect the dashboard for unfamiliar notices. | Unknown administrators, changed email addresses or settings you did not create. |
| Plugins and themes | Review the installed list and activate only the components the site needs. | Unknown plugins, altered names, fatal errors or a component that immediately redirects visitors. |
| Configuration | Check the site address, home address, permalink behavior and key integrations. | Login loops, 404 errors or links pointing to a staging or attacker-controlled domain. |
| Hosting | Review host alerts, scheduled tasks and account-level users with the provider. | Reappearing files or processes outside the WordPress directory. |
Keep the site restricted while these checks run if your host provides a safe staging or maintenance option. Do not change passwords and then assume validation is complete; first establish that the restored code and database are the intended clean versions.
7. Close the access path after the restore
A restore returns files and data to an earlier point; it does not explain why the attacker gained access. Once the restored site is confirmed and you are no longer relying on the compromised credentials, carry out the account and platform changes below.
Change every relevant password
Change WordPress administrator passwords, hosting-panel credentials, file-transfer credentials, database credentials and any service passwords stored in the site. WordPress.org recommends changing site passwords again after cleanup, not merely during the emergency response. Use separate credentials for each service and remove accounts that are no longer required. Have every legitimate administrator change their password, including accounts that showed no obvious misuse.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Replace the WordPress secret keys
Replace the authentication and session secret-key values in wp-config.php with new values supplied through the normal WordPress configuration process. This invalidates existing login cookies, including sessions an attacker may still hold. Plan for every administrator to sign in again after the keys change.
Update WordPress, plugins and themes
Bring WordPress core, plugins and themes to supported versions after confirming compatibility with the host. Remove components that are unused or no longer maintained rather than leaving dormant code available to an attacker. Do not update by copying files from the compromised installation; obtain clean packages through the normal WordPress or developer distribution path and keep a record of what changed.
Scan the administering computers
Scan the local computers used to administer the site, especially the machine that stored passwords or uploaded files. A compromised workstation can steal the new credentials and reinfect an otherwise clean site. Complete this check before treating the new passwords as trustworthy.
Identify the original entry point
Review the timeline with the host and look for the first unauthorized user, plugin or theme change, vulnerable integration, leaked credential or hosting-account event. Ask the provider about access logs and server-level indicators. If you cannot determine the entry point, use professional incident-response help; otherwise the same weakness may remain available after every restore.
8. Troubleshoot common restore failures
The site shows a database-connection error
Check the database name, user, password and host in wp-config.php against the values supplied by the host. Confirm that the database user has permission to the selected database and that the import actually completed. Do not assume a file upload failure is the cause until the provider confirms the database service and credentials.
Best Value
- USB-C and USB 3.1 compatible.Specific uses: Business, personal
- Innovative style with refined metal cover
- Password protection with 256-bit AES hardware encryption
- Formatted for Mac
The homepage works but inner pages return 404 errors
This usually indicates a rewrite or permalink mismatch, an incomplete file restore or a host configuration difference. Ask the host to verify the restored document root and rewrite support, then review the site’s permalink settings. Preserve the current state before making broad configuration changes.
Images or downloads are missing
Verify that the uploads directory was included in the file backup and that its paths match the database restored from the same point. If files and database came from different dates, obtain a matching pair rather than copying unknown media from the compromised site.
A plugin or theme causes a fatal error
Use the host’s recovery or file-management procedure to disable the offending component, then check its version against the restored WordPress core and PHP environment. Replace it with a clean, supported copy or remove it if it is unnecessary. Do not reactivate every component at once; enable them individually while monitoring the site.
The compromise returns after restoration
Stop making repeated restores. Preserve the new state, contact the host and review the original entry point, account credentials, scheduled jobs and administering computers. A reinfection can come from a stolen password, a vulnerable component outside WordPress or a host-level compromise, so a second file replacement alone may not solve it.
9. Build a backup plan that can support the next recovery
WordPress backup guidance recommends maintaining multiple copies and keeping copies in more than one location, including a local computer or hard drive when appropriate. A local drive is optional storage, not a backup by itself: it becomes useful only when it contains a verified copy of both the files and the database.
- Schedule backups at an interval that matches how often the site changes.
- Retain multiple restore points so one damaged or compromised copy does not eliminate every option.
- Keep at least one copy separate from the hosting account that runs the site.
- Label each set with the file timestamp, database timestamp, time zone and site or environment.
- Periodically verify that an archive can be opened and that its database export is present.
- Document the host’s restore procedure, database limits and support contact before an emergency.
- After major WordPress, plugin or theme changes, create a known-good restore point and record what changed.
These checks make the next incident a controlled recovery rather than a guess about which files and database belong together.
10. When to hand the recovery to a professional
Use the host’s incident-response team or an experienced WordPress security professional when the backup cannot be dated confidently, the host account may be compromised, multiple sites share the account, the attacker still has access, or the site contains regulated or high-value data. Professional help is also appropriate when you need forensic evidence, cannot safely preserve the infected snapshot, or the site continues to reinfect after credentials and software are changed.
Give the responder the incident timeline, preserved compromised snapshot, candidate clean backups, host details and a list of changes already made. That information prevents destructive trial-and-error and helps distinguish a bad restore from an unresolved access path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
