Full procedure for handling a hacked WordPress site

Purpose of the article

This article describes step by step how Securantis conducts an intervention on a WordPress site suspected of being hacked: initial audit, backup, assisted manual cleaning, hardening, validation and final report. The objective is to make the site safe, to explain each decision and to give you the tools to verify integrity without automatically deleting files that may be legitimate.

Prerequisites before intervening

• WordPress administrator access and FTP/SFTP access or SSH access to the web server (read/write on the WordPress tree).
• Database access (via phpMyAdmin, Adminer or direct access).
• External backup available (if you do not have one, creating a full backup is part of the first steps).
• Active Securantis license (to synchronize the report if necessary).
• Clear communication with the site owner: determine acceptable downtime windows and who validates deletions/restorations.

Detailed steps of the intervention (numbered)

1. Initial audit and footprint collection

• Objective: assess the extent of the compromise without modifying the site.
• Actions: run a full scan (core, plugins, themes, uploaded files) to obtain a score and a list of anomalies classified (information / warning / critical). The scan also identifies isolated files, suspicious files and those placed in quarantine.
• Expected result: discovery report indicating affected areas, overall security score and the scan UUID for traceability.

2. Full backup (before any modification)

• Objective: ensure a possible restore before any deletion or alteration.
• Actions: perform a full backup of WordPress files and a copy of the database. Store these backups off the server (cloud storage or secure third-party server).
• Precaution: never store passwords in plain text in a ticket or email. Accesses for paid assistance are provided only after payment and via the secure client area.

3. Quarantine and isolation

• Objective: reduce the risk of propagation without deleting automatically.
• Actions: isolate suspicious files identified by the scan (for example, move them to a quarantine folder accessible only to administrators or rename the files). Do not delete anything before manual inspection.
• Expected result: the site remains accessible if possible, but suspicious elements are neutralized pending analysis.

4. Manual analysis and triage

• Objective: distinguish false positives, legitimately modified files and malicious code.
• Actions: for each flagged file, compare the content with an official reference version (core, plugin, theme) or with known-good backups. Examine isolated files and uploaded files (webshells are common in media folders).
• Precaution: a heuristic flag is not proof. Document the origin of each correction.

5. Assisted cleaning

• Objective: remove or restore only confirmed malicious elements.
• Actions:
  • Restore corrupted files from backup or from an official source for core, plugins and themes.
  • Delete files identified as malicious after making an off-site copy (dated archive).
  • Correct the database if injections or malicious users are detected (remove unauthorized accounts, clean malicious options, verify roles).
• Expected result: clean code without persistent unknown elements.
• Precaution: keep a dated copy of removed items and document the reason for each deletion.

6. Post-cleaning hardening

• Objective: reduce attack vectors and fix weak configurations.
• Typical actions:
  • Enforce HTTPS if the site is not yet using HTTPS.
  • Update PHP to a supported and secure version.
  • Update WordPress, plugins and themes to known safe versions.
  • Disable debug mode in production.
  • Check the integrated file editor and disable it if possible.
  • Restrict or disable xml-rpc if not used.
  • Install or strengthen authentication (2FA) and enable CAPTCHA on login forms if relevant.
  • Implement a strong password policy and review existing administrator accounts.
• Prudent settings: apply non-intrusive measures first (HTTPS, updates), then schedule more impactful changes (disabling functions or database modifications) outside peak hours.

7. Final verification and rescans

• Objective: ensure the site is clean and stable.
• Actions: run a new full scan and compare the score, checks and file list. Confirm there are no items in quarantine and no unresolved critical discoveries.
• Expected result: improved security score (operational target often >75), no critical findings and a stable state of reference files.

8. Report and recommendations

• Objective: provide a complete report and preventive actions.
• Report content: summary of initial findings, backups performed, list of files deleted or restored (with archived copies), changes applied, recommendations to prevent recurrence (regular updates, monitoring, 2FA, automated backups).
• Delivery: optional synchronization to the Securantis dashboard if the license is active.

Common errors and troubleshooting

• The scan reports many modified files after a legitimate update: refresh the reference or restore the baseline if you have verified the changes come from an official update.
• Download of an update fails for the Securantis plugin: check connectivity, package validity and the SHA-256 fingerprint provided by the official source before continuing.
• The site remains infected after apparent cleaning: look for backdoors in mu-plugins, uploads directories, or malicious cron tasks. Also check administrator accounts and API keys stored in options.
• Scan interrupted by the host or WP-Cron: relaunch the scan manually and verify task scheduling; use a manual run if necessary.

Precautions and security rules

• Never delete en masse without analysis: quarantine and dated archiving are essential.
• Never claim a malware is "automatically removed." Any deletion is a human decision that must be documented.
• Never transfer passwords by email or chat. Access for paid assistance is provided via the secure client area after payment.
• Keep regular backups and test restorations.

When to contact Securantis support

Contact support if:

• You are unable to identify the origin of suspicious files.
• Critical files appear modified but no official source matches.
• The infection reappears after cleaning and hardening.
• You need an in-depth manual intervention (server/SSH access), which may be a paid service.

What Securantis support will do

Support can guide you step by step, analyze logs, check suspicious files, recommend restorations, and — if you subscribe to a paid intervention — obtain the necessary accesses via the secure client area to perform corrections. Any destructive action will be validated by you beforehand.

Expected result at the end of the intervention

A clean and hardened WordPress site: increased security score, critical incidents resolved or documented quarantines, backups available, hardenings applied and a final report detailing each action and recommendations for future prevention.