My WordPress Site Was Hacked: What to Do in the First Hour

The moment you realize a WordPress site is compromised -- a defaced homepage, a spam-redirect, an unfamiliar admin account, a hosting warning about outbound spam -- the instinct is to start deleting suspicious files right away. Do that too fast and you destroy the evidence that would have told you how the attacker got in, which means the exact same vulnerability is still open after cleanup and the site gets reinfected within days.

Before touching anything, take a full backup of the site exactly as it currently is, infected state included. This isn't the backup you'll restore from -- it's a forensic snapshot, in case you need to understand the attack later or prove what happened for a client or compliance reason. Note the exact time you discovered the compromise and anything unusual you noticed leading up to it.

If the site is actively harming visitors -- serving malware downloads, redirecting to scam pages, or sending spam -- the priority shifts to containment over full cleanup. Taking the site into maintenance mode or restricting public access stops active harm while you investigate, without destroying the compromised state you might need to examine. If it's an e-commerce site, check whether customer payment data could have been exposed; that changes your obligations beyond just fixing WordPress.

Change every credential that could plausibly be involved -- WordPress admin passwords, database password, hosting account password, FTP/SFTP credentials, and any API keys stored in the site -- but change them after you've captured evidence, not before, since some attacks specifically watch for a password-reset event as a sign they've been discovered.

A new admin account, an injected file, and a defaced page are symptoms. The entry point is usually one of: an outdated plugin or theme with a known vulnerability, a weak or reused admin password, a compromised FTP credential, or a vulnerable component on the same shared hosting account. Cleaning up symptoms without finding the entry point means the same door is still unlocked.

Compare the current plugin and theme inventory against what should be installed, and check modification timestamps across wp-content for files that changed around the time you believe the compromise started -- files modified outside of a normal update window are the strongest lead. WPFixAgent's independent core-file integrity check and behavioral malware scan surface exactly this kind of evidence automatically, and quarantining a confirmed-bad file preserves it for investigation instead of deleting it outright, which matters if you need to understand what it actually did.