How to Recover from a Hacked or Compromised WordPress Site

Having your WordPress site hacked or compromised can be a distressing experience. However, with the right knowledge and approach, you can recover your site’s security and get it back up and running. In this tutorial, we’ll guide you through the process of recovering from a hacked or compromised WordPress site. We’ll cover all the necessary steps, from identifying the hack to implementing security measures. Whether you’re a beginner or a seasoned developer, this tutorial will help you restore your site’s integrity.

Step 1: Identify the Hack

To identify a hack or compromise on your WordPress site, look for the following signs:

• Defaced pages: Check if any of your site’s pages have been altered or contain unfamiliar content.
• Unusual redirects: Test your site’s URLs to see if they redirect to unexpected or unrelated websites.
• Unauthorized access: Review your server logs for any suspicious login attempts or unauthorized access.
• Blacklisting: Check if your site has been blacklisted by search engines or security services using services like Google Safe Browsing or Sucuri SiteCheck.

• Checking with Google Safe Browsing:
  1. Open your web browser and go to the Google Safe Browsing Transparency Report page (https://transparencyreport.google.com/safe-browsing/search).
  2. Enter your website URL in the search bar and click the “Search” button.
  3. Google Safe Browsing will display the status of your site. If it’s listed as “Not Dangerous,” your site is not currently blacklisted. However, if it’s listed as “Dangerous,” your site might be blacklisted, and you should take immediate action to investigate further.
     
• Checking with Sucuri SiteCheck:
  1. Visit the Sucuri SiteCheck website (https://sitecheck.sucuri.net/).
  2. Enter your website URL in the scanning field and click the “Scan Website” button.
  3. Sucuri SiteCheck will analyze your site for malware, blacklisting, and other security issues.
  4. The scan results will indicate if your site is blacklisted or if any security concerns are detected. Review the findings and take appropriate actions based on the recommendations provided.

Performing blacklisting checks using Google Safe Browsing and Sucuri SiteCheck will help you determine if your site has been flagged as potentially harmful or compromised. If you find that your site is blacklisted, it’s essential to proceed with the remaining steps in this tutorial to recover and secure your WordPress site.

Step 2: Take the Site Offline

To prevent further damage and protect your visitors, put your site into maintenance mode. Open the index.php file in your child theme directory and add the following code at the top:

<?php
// Maintenance mode
wp_die('Under maintenance. Please check back soon.');
Code language: PHP (php)

Save the file and upload it to your server, overwriting the existing index.php file.

Step 3: Backup Your Site

Creating a complete backup of your WordPress site ensures that you can restore it if anything goes wrong during the recovery process. Here’s how to back up your site:

1. Access your website files via FTP or through your hosting provider’s file manager.
2. Download all the files in your WordPress installation to your local computer.
3. Export your WordPress database using a tool like phpMyAdmin or a plugin like WP-DB-Backup.
4. Save the backup files in a secure location, such as a separate server or cloud storage service.

You can backup your website using Duplicator. Learn more via our other turtorial “How to Clone, Backup and Migrate your WordPress website“.

Step 4: Change All Passwords

Resetting all passwords associated with your WordPress site is crucial to prevent unauthorized access. Here’s what you need to do:

1. Log in to your WordPress dashboard and navigate to the Users section.
2. Change the password for each user account, including the admin, editor, and other roles. To learn how to reset passwords for all users in WordPress, you can refer to our tutorial on “How to Reset Passwords for All or Selected Users in WordPress.“
3. Use a strong, unique password for each account. Consider using a password manager to generate and store secure passwords. You can also use the Hoolite password generator tool.

Scan for Malware and Clean Infected Files

To remove any malware or suspicious code from your WordPress site, follow these steps:

1. Access your site’s files using FTP or your hosting provider’s file manager.
2. Scan your files manually or use a reliable security plugin, if available, to scan for malware.
3. Look for any suspicious files or modifications, especially in the theme and plugin directories.
4. Delete any infected files or restore them from a clean backup.
5. Remove any unauthorized or unfamiliar code from your theme’s files.

Here are a few popular and trusted security plugins:

1. Wordfence Security: Wordfence is a comprehensive security plugin that offers features like malware scanning, firewall protection, login security, and more. You can download and install it from the official WordPress repository here.
2. Sucuri Security: Sucuri Security provides website security solutions, including malware scanning, blacklist monitoring, security hardening, and post-hack measures. You can find the plugin in the WordPress repository here.
3. MalCare Security: MalCare is a powerful security plugin that offers malware scanning, automatic malware removal, firewall protection, and website hardening. You can get MalCare from the WordPress repository here.

Remember to install and activate only one security plugin at a time to avoid conflicts. These plugins will assist you in scanning your site for malware, identifying infected files, and taking necessary actions to clean them up.

Update WordPress and Plugins

Updating your WordPress core, themes, and plugins to their latest versions is essential for security. Follow these steps to ensure your site is up to date:

1. In your WordPress dashboard, navigate to the Updates section.
2. Update the WordPress core if a new version is available.
3. Update all installed plugins to their latest versions.
4. Remove any unused or unnecessary themes and plugins from your site.

Strengthen Security Measures

To enhance your site’s security and prevent future hacks, follow these steps:

1. Open the wp-config.php file in your child theme directory.
2. Add the following line of code above the “/* That's all, stop editing! Happy blogging. */” comment:

define('DISALLOW_FILE_EDIT', true);
Code language: PHP (php)

Implementing this code snippet helps safeguard your site by restricting the ability to modify theme and plugin files through the WordPress dashboard. To learn how to enhance the security of your WordPress website by adding essential headers through the functions.php file, you can refer to our tutorial on “Boost WordPress Security by Adding Essential Headers through functions.php.”

By following these steps, you’ll strengthen the security of your WordPress site and reduce the risk of unauthorized modifications.

3. Consider implementing additional security measures, such as:
   – Limit login attempts and enable two-factor authentication.
   – Install a web application firewall (WAF) to block malicious traffic.
   – Regularly monitor your site for suspicious activities.

Harden File Permissions

Setting appropriate file permissions helps protect your site against unauthorized access. Follow these steps:

1. Access your site’s files using FTP or your hosting provider’s file manager.
2. Set the correct file permissions for your WordPress installation:
   • Directories: 755 (drwxr-xr-x)
   • Files: 644 (-rw-r–r–)
3. Ensure that sensitive files, such as wp-config.php, have more restricted permissions:
   • Directories: 755 (drwxr-xr-x)
   • wp-config.php: 600 (-rw——-)

Monitor and Stay Vigilant

To maintain the security of your WordPress site, it’s important to stay vigilant and proactive:

1. Regularly monitor your site for any signs of suspicious activities or security vulnerabilities.
2. Stay informed about WordPress updates, plugin/theme vulnerabilities, and security best practices.
3. Consider subscribing to a security service that provides real-time threat monitoring.

Request Malware Review and Remove Blacklisting

If your site was blacklisted by search engines, follow these steps to request a malware review and remove the warning:

1. Check which search engine(s) have blacklisted your site.
2. Use the respective search engine’s webmaster tools to request a malware review.
3. Follow the instructions provided to submit your site for review and reconsideration.

Recovering from a hacked or compromised WordPress site requires a systematic approach and diligent effort. By following the steps outlined in this tutorial, you can restore your site’s security and protect it from future attacks. Remember to always prioritize security measures, keep your WordPress core, themes, and plugins up to date, and regularly monitor your site for any signs of compromise. That’s it! Your site is now on the path to recovery and improved security.