Act as though the compromise can reach every account and service connected to the site. First record what happened, then contain access without destroying evidence. Rotate credentials from a clean computer, investigate both the WordPress installation and the VPS, and recover only from a verified-clean backup or a fresh, patched server. Keep the site isolated until you have removed persistence and added stronger controls.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
1. Document the incident before changing or deleting anything
A hacked site is an incident, not merely a broken webpage. Before reinstalling WordPress, deleting files or rebooting the server, create a written timeline. WordPress.org’s security guidance places documentation first because early changes can destroy clues about the entry point and scope.
As an Amazon Associate I earn from qualifying purchases.
- Record every visible symptom: defacement, redirects, unfamiliar administrator accounts, spam pages, pop-ups, disabled features, suspicious emails or browser warnings.
- Write down when each symptom was first noticed, including the time zone, and when the site last appeared normal.
- Note recent changes to plugins, themes, WordPress core, PHP, the operating system, server configuration, DNS, firewall rules and hosting settings.
- Save hosting-provider alerts, security notifications, customer reports, search-engine warnings and payment or email-abuse notices.
- Capture screenshots and copy suspicious URLs, usernames, filenames and error messages.
Use a separate, trusted device or a paper record if you suspect the administrator’s computer is infected. Do not log in repeatedly from a potentially compromised machine while collecting information.
2. Contain public access and determine the likely scope
Containment limits damage while you investigate. If practical, place the affected site behind a maintenance page, restrict traffic at the host or firewall, or temporarily shut down the exposed service. CISA incident-response guidance recommends isolating affected systems; the exact control depends on your provider and architecture.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Taking one WordPress directory offline is not enough when the VPS itself may be compromised. Ask the host whether other sites, accounts, snapshots, databases, API credentials or network services on the same VPS show suspicious activity. A root-level intrusion can persist outside public_html or the directory where WordPress is installed.
When isolation is urgent
- Unknown processes, shell users, SSH keys, scheduled tasks or firewall changes appear on the VPS.
- The server is sending spam, scanning other systems, mining cryptocurrency or generating unexplained outbound traffic.
- Multiple sites or applications on the VPS show the same symptoms.
- You cannot identify which files or accounts were changed, or the attacker still appears to have access.
If taking the service offline would affect critical operations, restrict it as tightly as possible and involve the hosting provider or an incident-response professional immediately.
3. Preserve evidence before cleanup
Preserve a copy of the affected environment before you rebuild or run destructive cleanup. At minimum, retain the WordPress files, database dump, web-server logs, authentication and SSH logs, control-panel logs, firewall records, suspicious binaries and a timeline of file timestamps. If your provider supports a disk image or snapshot, ask how to capture it without overwriting the original.
CISA notes that highly volatile evidence or data with short retention—such as system memory, security logs and firewall-log buffers—can disappear or be tampered with. Preserve those sources when you have the skill and tooling to do so safely. Otherwise, ask the host or a qualified responder to collect them.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Store evidence in read-only or access-controlled storage separate from the compromised VPS.
- Record who collected each item, when, and from which hostname or server.
- Do not open suspicious executables on your everyday computer.
- Keep the original copy intact; perform analysis on a duplicate.
Evidence matters if you need to identify the entry point, prove what data was accessed, satisfy a regulator or insurer, or prevent the attacker from returning after an apparently successful cleanup.
4. Change every exposed credential from a clean device
Assume that any secret reachable from the compromised environment may have been copied. Use a computer you trust, preferably one that has been fully updated and scanned, and rotate credentials in an order that removes the attacker’s access first.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Hosting-provider account and billing or support login.
- VPS control-panel password, root or administrator password, and every additional system user.
- SSH keys: revoke unknown keys, generate new pairs, and remove old authorized keys after confirming legitimate administrators have replacement access.
- SFTP and FTP accounts, including accounts used by deployment tools.
- WordPress administrator, editor and service accounts; delete unknown users and reset legitimate users’ passwords.
- Database users and passwords, including credentials stored in
wp-config.phpor deployment secrets. - API tokens for email, payments, analytics, backups, DNS, content delivery, repositories and monitoring.
- Email accounts, DNS or registrar accounts, CDN and firewall dashboards, and any third-party identity provider.
- Every password reused on another service.
WordPress.com guidance specifically calls for account, WP Admin and SFTP/SSH resets. Revoke sessions and tokens where a service offers that control; changing a password alone may not invalidate an existing session.
5. Turn on multifactor authentication
Enable MFA after resetting credentials, starting with the hosting account, email, WordPress administration and identity systems that can reset other passwords. A one-time code from an authenticator app or phone is better than a password alone; a physical security key can provide a stronger second step when the host, identity provider, control panel or SSH configuration supports it.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Register at least two recovery methods, store emergency codes offline and test the recovery process before closing the incident. Do not leave a shared administrator login protected only by a single person’s phone.
6. Investigate WordPress, the VPS and administrator computers
Cleaning the visible homepage does not establish that the system is safe. Investigate three layers separately and compare their timelines.
WordPress and web requests
- Review WordPress activity, authentication and HTTP-request logs for unfamiliar IP addresses, login times, uploads, plugin installations and account creation.
- Compare WordPress core, plugin and theme files with clean copies of the same versions. Look for unexpected PHP files, modified templates, obfuscated code and web shells.
- Check
wp-content/uploads, temporary directories, configuration files and rewrite rules for executable or recently changed content. - Inspect scheduled events and cron tasks for jobs that recreate malware or create administrator accounts.
- Look for outbound requests, spam mail and redirects that begin only on certain pages or for particular visitors.
VPS and hosting layer
- Review SSH, sudo, control-panel, web-server and firewall logs, plus active users, authorized keys, processes, listening ports and scheduled jobs.
- Check for new system accounts, privilege escalation, altered startup scripts, changed DNS records, unknown containers and unexpected binaries.
- Inspect every virtual host, database and application on the server rather than assuming the WordPress site was the only target.
- Ask the provider for hypervisor, network or abuse notices that are not visible inside the guest operating system.
Administrator endpoints
Run a full malware scan on every laptop or desktop used for WordPress, SSH, FTP or hosting administration. WordPress.org warns that a local infection can steal FTP and /wp-admin credentials; cleaning the server while leaving that endpoint infected can immediately reinfect the replacement.
Use more than one appropriate scanning method for the site and endpoint, but treat scanner results as evidence, not proof of cleanliness. A scanner can miss a new or deliberately hidden backdoor, so file comparison, logs and a clean rebuild remain important.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
7. Choose a recovery path deliberately
There is no universally safe “restore” button. Choose based on containment speed, evidence quality, confidence that the recovered material is clean, the scope of the compromise, your technical skill and acceptable downtime.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| Recovery option | Best fit | Advantages | Risks and requirements |
|---|---|---|---|
| Temporary isolation and investigation | You need evidence or the scope is unknown | Stops ongoing abuse while preserving the original environment for analysis | Downtime continues; requires careful log and image preservation |
| Restore a pre-incident backup | A backup clearly predates the compromise and can be verified | Usually faster than rebuilding and retains known site content | The backup may contain the same backdoor or stolen secrets; scan and test it before exposure |
| Fresh VPS rebuild | Root access, persistence or server-wide compromise is possible | Removes unknown changes from the operating-system and hosting layers | Requires documented configuration, clean application packages and a controlled data migration |
| Qualified incident-response help | Legal, payment, regulatory, multi-site or technically complex cases | Improves evidence handling, scoping and notification decisions | Involves cost and coordination; preserve the original environment before handing it over |
CISA recommends restoring from offline, encrypted backups, prioritizing critical services and avoiding reinfection during recovery. Do not copy unknown executable files, modified plugins or themes from the compromised tree into the replacement.
How to validate a backup
- Identify when the backup was created and compare that time with the first suspicious activity.
- Keep the original backup immutable and restore a working copy into an isolated environment.
- Scan the files and database, compare core, plugin and theme versions, and inspect users, scheduled tasks, redirects and injected content.
- Change all secrets before the restored copy can connect to production services.
- Test logins, forms, email, payments and integrations while the copy remains isolated.
- Reconnect only after patching and hardening the complete stack.
8. Patch and harden every layer before reconnecting
Update WordPress core, every retained plugin and theme, the operating system, web server, PHP runtime, database and exposed services. WordPress.com identifies outdated plugins and themes as common entry points. Remove abandoned, pirated, unused or unnecessary components rather than merely disabling them.
- Use separate, least-privilege accounts for publishing, deployment, databases and system administration.
- Restrict SSH to approved networks or a secure access path, disable password login when practical, and remove unused users and keys.
- Limit write permissions so the web process cannot modify application code unless a documented update requires it.
- Protect the administration area with MFA, rate limiting and sensible login controls.
- Rotate database, API and deployment secrets again after migration if they were present on the old host.
- Set up encrypted, offline or otherwise isolated backups and test restoration regularly.
- Enable file-integrity, uptime, login and outbound-traffic monitoring, with alerts delivered outside the VPS.
Do not reconnect a server simply because the homepage looks normal. Confirm that persistence mechanisms, unauthorized accounts, malicious scheduled tasks and altered DNS or firewall rules are gone.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
9. Monitor, notify and close the incident carefully
For several weeks after recovery, watch authentication and web logs, file-integrity alerts, outbound traffic, email-delivery reputation, search-engine warnings, antivirus detections and new redirects. A reappearance of an old administrator account, modified file or unknown scheduled job is a reason to isolate the service again rather than patching the symptom.
Recommended Free Tools
If personal data, payment information or regulated information may have been accessed, follow your incident-notification plan and obtain legal or professional advice. Notification duties depend on the data, people affected and jurisdictions involved; do not guess at deadlines or scope. Preserve evidence and your timeline for counsel, insurers, payment providers and authorities.
After closure, write down the initial entry point if known, affected assets, credentials rotated, backups used, patches applied, monitoring added and decisions that remain uncertain. That record reduces recovery time if a related alert appears later.
How to tell whether only WordPress or the whole VPS was compromised
You cannot establish scope from a defaced page alone. A problem limited to one installation is more plausible when system accounts, SSH configuration, other virtual hosts and host-level logs remain unchanged and the malicious files map to a vulnerable plugin or theme. Treat the VPS as compromised when you find root-level access, unknown SSH keys, altered system binaries or startup scripts, suspicious processes, new privileged users, changed firewall or DNS settings, or similar activity across multiple sites.
When evidence is incomplete, use the broader assumption: rebuild the VPS, rotate every reachable secret and ask the provider to review host-level telemetry. A narrower cleanup that misses persistence can expose every later password and backup.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →When to call the host or an incident-response professional
- You cannot preserve logs or a forensic image without overwriting evidence.
- The attacker had root, control-panel or cloud-account access.
- More than one site, server or customer account is involved.
- Payment-card, health, identity or other regulated data may be affected.
- You need to determine notification, insurance or contractual obligations.
- No backup can be shown to predate the compromise, or every backup may contain the same malware.
The hosting provider can help isolate infrastructure, review account and network activity, and identify whether neighboring services were affected. A qualified responder can preserve evidence and establish scope; neither should be asked to work from a single unverified copy while the original is being overwritten.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
