WordPress Site Hacked? What to Do in the First Hour

A hacked WordPress site needs prompt containment, evidence preservation and a clear recovery owner. The first hour is not a promise that cleanup will finish in sixty minutes. It is a chance to protect visitors, avoid destructive guesses and give the hosting provider or security specialist useful facts.

Confirm what suggests a hacked WordPress site

Record the affected URLs, visible warnings, unfamiliar redirects or unexpected administrator accounts. Note when you first noticed the problem and include the timezone. Preserve screenshots where safe, without entering personal information into suspicious forms or bypassing browser security warnings.

The official WordPress hacked-site guide recommends documenting symptoms and involving the hosting provider. An old search snippet or an outage alone does not prove the same cause as live malicious content, so keep observations separate from conclusions.

Protect visitors and coordinate containment

Contact the hosting provider and the authorised website administrator through a trusted route. If the site is serving harmful content, ask them to assess appropriate temporary restrictions while preserving a recovery path. Do not keep directing customers to a suspect payment or enquiry page simply because the homepage still opens.

Name one person to coordinate the response. Record who can approve emergency changes and how the business will handle enquiries while the site is affected. This reduces the risk of several people making conflicting repairs at the same time.

Preserve evidence from the hacked WordPress site

Ask the responsible technical person to preserve relevant files, database data and available logs before destructive cleanup. Keep affected copies isolated and access-controlled; do not leave an infected archive in a public website folder. Retain earlier backups rather than overwriting every recovery point with the current state.

A compromised copy can help explain what happened, but it is not a clean restore point. Record which backups predate the suspected incident and what evidence supports that assessment. Do not assume the newest backup is the safest one to restore.

Review access from a trusted device

Have the authorised administrator contain known-compromised accounts and sessions using the relevant provider procedures. Review WordPress, hosting and other access paths that may be involved, while ensuring the legitimate owner retains recovery access. Keep credentials and recovery secrets out of ordinary messages and support screenshots.

Coordinate access changes with the wider cleanup. If a device or malicious process still captures credentials, a password change alone will not resolve the incident. The Australian Government’s website security guidance provides a baseline for access protection, supported software and backups.

Plan investigation before deleting files

Ask what the scan checked, whether it completed and which findings are confirmed malicious. Review unfamiliar file differences in context because legitimate customisations can look unusual. A clean scan is useful evidence, not a guarantee that every access path or injected record has disappeared.

The investigation should consider both the unwanted changes and the route that allowed them. Repeatedly restoring the same vulnerable software can leave that route open. Our recurring malware guide explains why removing a visible symptom may not stop reinfection.

Set recovery criteria for the hacked WordPress site

Before reopening normal use, agree which checks must pass: affected URLs, redirects, important forms, access reviews and the identified vulnerability or compromise route. Preserve the result and any unresolved issue in the incident record. Seek specialist advice where customer data or payment systems may be involved.

Request search or browser-warning review only after the relevant remediation and verification. See our search warning recovery guide for that separate stage. TempWebz provides WordPress malware removal support and technical support without treating an emergency as a reason for an unnecessary redesign.