Contain the compromise.
Recover without losing evidence.

Rotate forgotten WordPress incident credentials across email, hosting, database, SFTP, DNS, SMTP, payment, backups and integrations.

Rotate WordPress authentication keys and salts safely, revoke sessions and application passwords, and verify configuration ownership after compromise.

Update recovered WordPress safely with clean backups, staging, compatibility checks, maintenance, rollback and business-path verification.

Monitor privileged users, application passwords, plugin/theme installs and update events after WordPress recovery with actionable alerts.

Triage WordPress file-change alerts after recovery by path, owner, deployment, executable risk, recurrence and trusted package comparison.

Prepare a Google Safe Browsing security review after WordPress recovery by proving malicious content is removed and access paths are closed.

Find WordPress persistence outside plugins and themes by inspecting mu-plugins, uploads, wp-config, cron, database, server configuration and accounts.

Preserve WooCommerce orders, payment events, checkout code, users, logs and configuration before emergency containment and clean recovery.

Stop malicious WordPress or server cron from recreating hacked files by preserving task evidence, tracing its code and rebuilding safely.

Investigate unknown WooCommerce orders and users using payment evidence, logs, user roles, API keys and precise cleanup without deleting real customers.

Recover authorised WordPress access through verified email, hosting, WP-CLI or scoped database changes without hiding a permanent administrator.

Recover from WordPress database persistence in options, users, cron, posts and page-builder content using snapshots and precise validated changes.