Restore a WordPress site only after you have preserved evidence, assessed the backup, removed the vulnerable entry point and checked for persistence. A backup can return files and database content to an earlier state, but it does not prove that the attacker was limited to those components or that the original access path is closed.
The safest recovery is an ordered process: document what you see, preserve an affected snapshot, contain the site, choose between a verified restore and a forensic cleanup, replace compromised components with known-good copies, patch the vulnerability, rotate every relevant credential, investigate how access occurred, and monitor the result.
As an Amazon Associate I earn from qualifying purchases.
Start by answering: what are you seeing, and when did it begin?
WordPress.org’s hacked-site guidance uses a practical first question: What are you seeing that leads you to believe you are hacked? Write the answer before changing anything. A white screen, redirect, unfamiliar administrator, injected links, altered content, spam email, a hosting alert or a security scanner result each points to different evidence and recovery work.
Record the incident timeline
- Write down the first observed symptom, the exact date and time, and the timezone.
- List plugin, theme, WordPress core, hosting, DNS and configuration changes made shortly before the symptom appeared.
- Note which pages, users, files, database records or hosting services appear affected.
- Record the WordPress version, PHP version, hosting provider, control panel, web server and any available security or backup tools.
- Save alert emails, screenshots, HTTP error messages, scanner reports and support tickets in a separate location.
This record prevents assumptions from turning into evidence. It also gives a responder enough context to distinguish an exploited plugin from a separate hosting-account or credential compromise.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Preserve a snapshot before cleanup
Take a copy of the affected site before deleting files, reinstalling WordPress or restoring a backup. Preserve both the site files and the database, and keep the copy away from the live document root. Include web-server and hosting logs when the host makes them available. The copy may contain malicious code, but it can reveal what changed and may be needed if a cleanup attempt fails.
Do not open suspicious files on a workstation that is not prepared for malware analysis. If you cannot preserve the environment safely, ask the host or an incident-response professional to capture it. Never overwrite your only copy with a restored version.
Contain the site without destroying evidence
Containment limits further damage while preserving material needed to understand the intrusion. The right action depends on the symptom and your hosting controls.
Actions that usually reduce exposure
- Put the site behind a maintenance page or temporarily restrict public access if the host supports that safely.
- Disable the suspected plugin, but preserve its original files in the evidence copy first. If the plugin is the suspected entry point, do not reactivate it merely to test a theory.
- Ask the host to isolate the account or take a server-side snapshot when you suspect access beyond WordPress.
- Keep current logs, access records and backup metadata. Do not clear logs, delete unknown users or run a mass search-and-replace before recording the original state.
- Tell site owners and editors to stop logging in until session tokens and credentials have been dealt with.
Containment is not the same as remediation. A disabled plugin can leave web shells, altered database options, new administrator accounts or scheduled tasks behind.
Choose between restoring a backup and cleaning the existing installation
There is no universal restore method. Decide after comparing the evidence, the backup and the data created since the suspected compromise.
| Decision factor | Restore a pre-incident backup | Clean the existing installation |
|---|---|---|
| Backup confidence | Requires a dated copy that predates the intrusion and appears complete; its cleanliness still needs validation. | Does not depend on a known-clean restore point, but requires reliable evidence and technical work. |
| New content | Posts, orders, uploads and settings created after the backup must be exported or recreated. | Can preserve more recent legitimate data, but that data may contain attacker changes. |
| Vulnerable plugin | Must be removed or replaced before the restored site is exposed again. | Must be disabled, removed or upgraded as part of cleanup. |
| Persistence risk | Malware in the database, hosting account or another component can survive a file restore. | Newly added files and altered records must be found; incomplete cleanup can leave the attacker in place. |
| Required expertise | Lower operational complexity, but still needs validation and credential rotation. | Higher forensic and technical skill, especially when the entry point is unknown. |
| Best fit | A complete, tested, pre-incident backup exists and recent data can be preserved separately. | No trustworthy backup exists, the compromise is recent and bounded, or preserving current data is essential. |
When a restore is sensible
A restore is a strong option when you can identify a backup taken before the first suspicious event, verify that it contains both files and database content, and account for legitimate changes made afterward. Export or separately preserve newer content before replacing the live site. Treat the restored copy as a starting point for validation, not as proof of cleanliness.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
When in-place cleanup is necessary
Clean the existing installation when every available backup may have been created after the compromise, when the site has irreplaceable recent data, or when the evidence shows changes outside the files covered by the backup. This approach demands a careful inventory of files, database records, users, scheduled jobs and hosting access.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsA hybrid recovery often reduces risk
For a high-value site, create an isolated copy of the affected environment, build a second copy from the best pre-incident backup, and compare legitimate content with the evidence. Import only verified posts, media and settings into a freshly rebuilt installation. This takes more work but avoids choosing between an unverified backup and an unbounded cleanup.
Assess backups before using one
WordPress.org describes backups as essential to continuity and says they can let an owner restore service while forensic work continues. Its guidance states: “Backups are a critical piece of your continuation of operations, and should be something you actively plan for moving forward.”
Check what each backup contains
- Files: WordPress core, plugins, themes, uploads,
wp-config.phpand any host-level files included by the backup. - Database: posts, pages, users, options, metadata, comments and plugin-created tables.
- Timing: creation time, timezone and whether the copy predates the first suspicious activity.
- Integrity: whether the archive can be opened, the database imports successfully and expected file counts and site content are present.
- Scope: whether the backup covers only WordPress or also the hosting account, cron jobs, email, DNS and other applications.
No generic backup date can be called clean. If an attacker had already gained access, they may have modified files or database content before the backup ran. Compare several restore points and prefer the earliest one that is both usable and plausibly pre-incident.
Keep an independent copy
Store the preserved snapshot and selected backups outside the live hosting account. An external hard drive for backups can provide a separate copy, but it is only useful if it is disconnected or access-controlled when not in use, labeled with dates and periodically checked. Off-site storage, retention and restore testing matter more than a particular device.
Recover in an isolated environment first
Do not perform the first restore directly over the live site. Use a staging site, a separate hosting account or a locally isolated environment with access restricted until validation is complete.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Create the isolated destination. Use a new database and document root. Do not let it share writable directories or credentials with the compromised site.
- Restore the selected files and database. Record the backup identifier and every change made during the process.
- Remove the exploited plugin. If a fixed release is not confirmed, leave the plugin removed rather than reinstalling it from an old archive. A plugin that is no longer needed should not remain installed but inactive.
- Replace WordPress core, themes and plugins with known-good packages. Use the same supported versions when reproducing a pre-incident state for investigation, then move to versions that contain the vendor’s fix before public exposure.
- Inspect the restored site. Check administrator accounts, user roles, scheduled tasks, uploads, recently modified files, database options and redirects before connecting the site to its normal domain.
- Preserve legitimate newer data. Import only content you can verify. Do not copy an entire compromised
wp-contentdirectory or database back into the clean build without review.
Why overwriting files can fail
WordPress.org notes that common reinstall mechanisms may overwrite existing files without removing malicious files that an attacker added. A web shell with an unfamiliar filename, a modified upload, a rogue plugin directory or a server configuration file can survive an apparently successful reinstall. Replacing known components is useful, but it must be paired with an inventory that can find files outside the standard package.
Be deliberate with uploads and writable directories
Media directories are expected to contain user files, so they deserve particular attention. Review unfamiliar executable files, recent timestamps and extensions that do not match the site’s normal media. Do not blindly delete the entire uploads directory: doing so can destroy legitimate content and does not address database or hosting persistence. Preserve suspicious files in the evidence copy, then remove them from the production build after they are documented.
Review the database as well as the filesystem
Look for unexpected administrator accounts, changed administrator email addresses, unfamiliar options, injected scripts, altered home or site URLs, and new plugin tables or records. Compare suspicious records with the preserved snapshot. Database cleanup can damage content if performed by guesswork; obtain a database export first and use a qualified administrator when the changes are extensive.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Patch the vulnerable entry point before going public
Once the isolated copy is clean enough to manage, update WordPress core and every affected plugin and theme to supported versions that contain the relevant fix. Do not interpret “latest” as a universal version number: releases change, and the correct target depends on the date, the software branch and the vendor’s advisory.
- Confirm the plugin’s current supported release from its developer or distribution channel.
- Remove abandoned, unused or unneeded plugins instead of leaving them inactive.
- Update themes and extensions that can load the same vulnerable library or share the same credentials.
- Test forms, ecommerce functions, media, redirects, scheduled jobs and integrations after patching.
If the vulnerability has no fixed version, keep the plugin removed or disabled and apply the vendor’s documented mitigation. Do not expose a recovered site merely because its pages render.
Rotate credentials and invalidate existing sessions
Change credentials only after the site has been cleaned; changing them earlier can give an attacker new credentials to steal. Then rotate every credential that could have been exposed.
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Credentials to change
- All WordPress administrator and editor passwords, including accounts that appear unused.
- The hosting control-panel, SSH, SFTP, FTP and deployment credentials.
- The database user password, followed by the corresponding value in
wp-config.php. - API keys, SMTP passwords, payment integrations, CDN credentials and other secrets stored in WordPress or the host.
- Registrar, DNS and email-account credentials when the evidence suggests the hosting account or mailbox was involved.
Replace WordPress secret keys and salts
Regenerate the authentication keys and salts in wp-config.php after cleanup. WordPress.org explains that replacing these values invalidates existing logged-in sessions, forcing users and an attacker who stole session cookies to authenticate again. Make the change as a coordinated operation: administrators will be logged out, and the new database password must match the application configuration.
Investigate how the attacker entered
Restoration addresses service availability; forensics addresses recurrence. A site can look normal while the vulnerable plugin, a stolen hosting credential or another compromised application remains available.
Evidence worth reviewing
- Web-server access and error logs around the first suspicious timestamp.
- Plugin, theme and WordPress update history.
- Recently modified files and files outside normal WordPress packages.
- New users, role changes, password resets and changes to administrator email addresses.
- Database options, scheduled tasks and redirects that changed unexpectedly.
- Hosting, SSH, SFTP, CDN, DNS and email-login records.
- Backup logs showing when each copy was created and whether a restore or job failed.
Search for a coherent sequence rather than one suspicious timestamp. Shared hosting may provide incomplete logs, and an attacker may have deleted or altered evidence. WordPress.org notes that forensic work can be difficult without technical knowledge or sufficient logs. When the entry point cannot be established, treat the uncertainty as a reason to obtain help, not as proof that the site is clean.
Verify the recovered site before removing restrictions
A scanner result is one signal, not a certification. Validation should combine technical checks, application behavior and observation over time.
Pre-launch checklist
- The exploited plugin is removed or upgraded to a supported fixed version.
- Core, themes and remaining plugins are replaced or updated from trusted packages.
- Unknown files, users, scheduled tasks, redirects and database changes are explained or removed.
- All relevant passwords, API keys, database credentials and secret keys have been rotated.
- Forms, logins, uploads, email delivery, payments and integrations work as expected.
- Backups now run successfully and a test restore has been performed in isolation.
- Monitoring and log retention are enabled for the hosting environment.
Watch after reactivation
Review authentication events, file changes, new administrator accounts, outbound email, redirects and server errors closely after the site returns to public service. A repeat symptom shortly after restoration is evidence that the cleanup or the underlying access control is incomplete. Take another snapshot before making the next major change.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Harden the site after recovery
Use the incident to reduce the number of ways a future compromise can spread.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
- Keep WordPress, themes and plugins on supported releases and remove software that is no longer maintained or needed.
- Give each administrator an individual account with only the role required for their work.
- Protect hosting, database, email and deployment accounts with unique credentials and available multi-factor controls.
- Limit write access to directories that must accept uploads, and review who can change plugins or themes.
- Keep regular copies of both files and database data, with at least one copy outside the production account.
- Document the restore procedure, backup retention, responsible people and the time needed to recover.
- Test restoration periodically instead of discovering during an incident that an archive is incomplete.
These measures do not identify the original exploit by themselves. They make the next incident easier to contain and make recovery less dependent on a single untested backup.
When to bring in outside help
Get specialist assistance when you cannot identify the entry point, the attacker may have reached the hosting account, logs are missing, the site processes payments or personal data, or cleanup would risk destroying business records. WordPress.org points owners who need help toward its Hacked or Malware forum. A qualified incident-response or malware-cleanup service can also be appropriate; provide a preserved copy and timeline, and do not share passwords through an untrusted channel.
Ask any responder to explain what they examined, what they could not verify, which credentials must be rotated and how they will validate the result. A promise that a single scan proves cleanliness is not an adequate recovery plan.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Report a newly discovered plugin vulnerability responsibly
If you discovered a security flaw rather than merely finding that your site was exploited, do not publish exploit details while other sites remain exposed. WordPress.org’s plugin-security guidance says to keep the report confidential and directs reporters to the developer and the plugins team. Its handbook, last updated January 2, 2026, asks for a concise description, a link to the specific plugin and whether the reporter validated the issue.
Separate reporting from recovery: first protect the affected site and preserve evidence, then provide a reproducible, restrained report through the appropriate confidential route. Do not include passwords, private customer data or a full weaponized exploit in a public ticket.
What a platform-managed response can—and cannot—tell you
A WordPress.com account published May 21, 2026 described one platform’s response to an attack on an essential plugin. It reported use of a managed web-application firewall and restores from off-site managed backups. That is an example of how a hosted platform can combine filtering and recovery; it is not a requirement for every WordPress installation and does not establish that the same controls, restore terms or evidence are available on another host.
A National Vulnerability Database result also surfaced an example in which an interrupted restore could expose a backup archive on certain server configurations. The lesson is limited but important: backup and restore tooling needs secure configuration and current advisory review. Do not infer that your plugin, host or backup is affected without checking the exact advisory and affected versions.
Recommended Free Tools
The practical recovery sequence
For most site owners, the sequence below is the safest concise plan:
Quick Recap
- Document symptoms, timestamps, recent changes and the host environment.
- Preserve the affected files, database and available logs in a separate location.
- Contain public access and disable the suspected plugin without deleting evidence.
- Inventory backup dates, contents and integrity; preserve newer legitimate data separately.
- Restore or rebuild in an isolated environment, choosing the path that matches the evidence.
- Remove the vulnerable plugin and replace components with known-good, supported versions.
- Inspect files, uploads, database records, users and hosting-level access for persistence.
- Rotate WordPress, hosting, database, API, email and deployment credentials.
- Regenerate the WordPress secret keys and salts to invalidate existing sessions.
- Test the recovered site, restore backups in isolation, monitor activity and investigate the entry point before declaring the incident closed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
