Recovering a hacked WordPress site means regaining trustworthy control and verifying the affected business functions. We assess the visible symptoms and available evidence, agree scope and quote, then carry out the authorised intervention. The route depends on the installation and what is known about the incident.
If the dashboard is inaccessible or an administrator changed, start with compromised WordPress admin access recovery. The guides on an outdated plugin as a possible entry point and being locked out of a hacked WordPress admin explain information that can help the assessment.
Separate the visible symptom from the incident scope
Record what happened, when it was first seen and which visitors, URLs or actions are affected. A redirect, unknown account or hosting warning is a useful starting point. A site that loads normally for its owner may still behave differently for other sessions.
The WordPress incident guidance recommends documenting the symptoms and timing. The review then distinguishes observations, plausible explanations and causes supported by evidence. A file date or suspicious function name alone does not establish the complete intrusion path.
Preserve what is needed and agree containment
Before a destructive change, define the evidence and recovery copies needed for this installation. If visitors are currently exposed, agree containment with the owner and hosting provider. The response should account for affected sales, enquiries and external systems.
A backup can support recovery but may also contain the same compromise or omit recent orders. We establish its date, contents and restoration implications before proposing it as the recovery route.
Cleanup, backup restoration or rebuild: what are we quoting?
“Recover the website” can describe quite different jobs. Before quoting the intervention, we identify the environment, the available recovery material and the business journey that must work again. The assessment explains the proposed route and what could change that recommendation.
- Cleanup of the existing installation: assess the affected code, content and access, agree the corrections and test the incident conditions again. The scope should say which dependencies are included; a WordPress-only intervention does not cover an entire hosting account by default.
- Restoration from a reviewed backup: assess the candidate before switching the live site. Our guide to choosing a backup after a WordPress hack explains why age alone is insufficient. The proposal must also account for orders, enquiries or other changes made since that copy.
- Rebuild from trusted software: define the replacement environment, reviewed custom functionality and data to import. See when to consider rebuilding a hacked WordPress site. If hosting or another external system also needs work, identify its owner and include it in the scope or record it as a separate dependency.
The agreed proposal sets out included work, dependencies, verification, handover and any unresolved questions. If investigation reveals a wider incident, we explain the revised scope before extending the intervention. Use the assessment request below to describe the situation; the first message does not need credentials or a backup archive.
Review access persistence and the likely entry point
The agreed investigation may cover accounts, active sessions, maintained code, database changes, scheduled activity and hosting dependencies. Clean replacement packages must be matched to the installation and its required functions. Unknown material needs review before removal; a matching scanner pattern is not a verdict on its own.
Closing the route back in can involve a vulnerable component or compromised access. The findings determine the relevant corrections and authorised access changes. If the evidence is incomplete, the report retains that uncertainty rather than inventing a single cause.
Verify the original symptom and business journey
Tests should reproduce the original affected conditions and check the relevant login, forms, checkout, email or scheduled process. A transaction-producing test requires a controlled method. Temporary containment and a completed recovery are reported separately.
If Search Console or another provider shows a warning, technical remediation and that provider’s review are distinct steps. For deceptive content, Google’s guidance explains the review route after the problem has been addressed. We do not set Google’s review timetable.
What you receive and what to prepare
The agreed work should leave a record of findings, changes, tested conditions, remaining limitations and follow-up responsibilities. The owner can see what was verified and what still requires attention. No review can promise permanent immunity from future incidents.
For the first contact, prepare the URL, first alert time, visible symptom, current business impact, available backups and actions already taken. A reviewed excerpt or screenshot is enough to explain the initial situation.
Request a hacked WordPress recovery assessment or review the assessment and recovery process. Scope and quote are established before the intervention.
EVIDENCE-LED WORDPRESS RECOVERY
Scope and verify hacked WordPress recovery
The assessment separates visible symptoms, available evidence and the affected business functions. Containment, remediation and verification are agreed for the actual installation.
What we verify
- Original symptom and affected request conditions
- Relevant code, data, accounts and hosting dependencies
- Recovery copies and recent business data
- Tested conditions, remaining limitations and follow-up owner
What a verified outcome means
The close-out records the findings, agreed changes and tests. Temporary containment, completed corrections and unresolved questions remain distinguishable.
BEFORE THE ASSESSMENT
Common questions about this WordPress incident
Is reinstalling WordPress enough?+
A replacement can address maintained files, but it does not establish the state of accounts, data, other files or hosting dependencies. The scope follows the evidence.
Can you guarantee the site will never be hacked again?+
No. The work documents what was reviewed and corrected and what follow-up is required. Future changes and access remain part of the owner’s ongoing responsibility.
Does the first assessment start paid work?+
It defines the information needed and proposed scope. Intervention follows the agreed quote and authorisation.