A compromised mailbox can undo a WordPress recovery repeatedly because it owns password resets, hosting recovery and domain notifications. If access returns after every password change, inspect the identity chain around the site instead of assuming the malware simply “came back”.
Secure the mailbox before using it for recovery
Reset the email account from a known-clean device, revoke sessions/app passwords and review forwarding rules, delegates, recovery methods and OAuth applications.
Map every service recovered through that address
List WordPress admins, hosting, registrar/DNS, CDN, analytics/tag manager, payment services and backup accounts. Change recovery addresses or credentials in a controlled sequence.
Check historical reset activity
Review security logs for password-reset messages, forwarding, suspicious sign-ins and account-recovery changes around each site takeover.
Remove WordPress persistence separately
A compromised mailbox and a WordPress backdoor can coexist. Scan/rebuild the site as its own workstream instead of declaring the mailbox the only cause.
Protect high-value accounts with MFA/passkeys
Prefer phishing-resistant methods where available and keep recovery codes outside the mailbox being protected.
Prove the access chain is broken
Attempt the old sessions/app passwords, monitor new recovery emails and verify that an attacker with only the old mailbox state can no longer reset site/control-plane access.
See compromised email repeatedly resetting WordPress and then rotate the wider credential set.
Audit mailbox persistence, not only the password
Forwarding rules, delegates, OAuth grants, app passwords and trusted recovery methods can survive a password reset. Remove unknown entries and compare the security timeline with each WordPress takeover before declaring the mailbox recovered.