Ending incident mode does not mean stopping security attention. It means the recovery requirements are evidenced, urgent reconciliation is complete and remaining risks can be handled through a normal owned schedule.
Use a formal transition gate rather than the date the homepage came back.
Confirm malicious behaviour is gone
Verify reported redirects, phishing, spam, checkout code, unknown users/tasks/files and search warnings no longer reproduce across original conditions.
Test public DNS, mobile/referrer/first-visit, cron cycle and cache warm-up. A single administrator browser or scanner is insufficient.
Keep rapid containment available.
Confirm trusted software and data
Record source/version/owner for WordPress, plugins, themes and custom code. Verify database users/options/cron/snippets/content and assessed uploads.
Remove abandoned code, infected roots and public backups after required retention. Resolve unknown differences rather than accepting them for convenience.
Keep the clean release identifier.
Confirm access and secrets
Review approved accounts/tokens across WordPress, hosting, SSH/SFTP, database, email, DNS/CDN, tag manager, payment, backups and source control.
Verify rotations, session revocation, MFA and removal of temporary responders. Ensure no recovery secret remains in tickets/repositories/staging.
Document owners without values.
Confirm the entry path is addressed
State confirmed/likely vector, confidence, alternatives and controls closing all plausible high-impact routes. Patch/remove vulnerable components and secure stolen accounts.
If the vector is undetermined, use broader architecture/access controls and monitoring. Normal maintenance can begin only when the residual risk is explicitly accepted.
Check sibling/staging sites.
Confirm business reconciliation
Match WooCommerce orders/payments/refunds/stock/fulfilment, form entries/leads, account access and transactional mail across the incident/cutover window.
Resolve missing/unknown records and assign one authoritative status. Do not leave paid-order uncertainty as routine backlog.
Record owner sign-off securely.
Confirm full functional tests
Pass login/reset, forms/mailbox, checkout sandbox, payment/webhooks, orders, cron, uploads, mobile/languages and analytics. Verify no duplicate side effects.
Remove synthetic data and temporary allow rules. Check logs do not store secrets/customer bodies.
Retest after final DNS/cache configuration.
Confirm backups and rollback
Create and restore-test a protected clean backup. Ensure deployment repositories/automation cannot reintroduce malware, abandoned packages or old secrets.
Rollback should return to a verified clean release or safe maintenance, never the infected root. Document recovery time/data-loss expectations.
Keep incident evidence separately.
Confirm monitoring ownership
Maintain actionable alerts for privileged users, executable/config changes, cron, outbound mail, payment and original indicators. Each needs an owner and independent channel.
Complete a heightened observation period appropriate to risk, often including a full 30-day cycle for business-critical incidents.
Tune noise only with evidence.
Complete a post-incident review
Document timeline, impact, likely entry path/confidence, containment, recovery, detection gaps and preventive actions. Assign each action an owner/deadline.
Separate technical facts from legal/customer decisions and retain evidence under policy. Do not include credentials, payloads or unnecessary customer data.
Update hosting/deployment/backup/runbook inventories from the lessons.
Close incident-only access and records
Remove emergency accounts/keys/database tools/IP bypasses/debug logs and excessive permissions. Store the final evidence matrix, timeline and decisions under policy.
Securely dispose of unnecessary working copies. Keep notification/legal/payment records according to authorised requirements.
Schedule the next maintenance/access/backup review.
Hand off to named service owners
Transfer responsibility for updates, access reviews, backups, monitoring alerts, order/lead reconciliation and emergency contacts. Confirm each owner can access the required system through individual MFA-protected accounts.
Test an alert acknowledgement and routine maintenance change before closing incident ownership. Remove responders who no longer need access.
Record escalation thresholds and independent communication channel.
Return to a risk-based cadence
Normal maintenance should include inventory, updates, access review, backup restore tests, business-path checks and incident readiness. Increase frequency after major changes or new threats.
Request recurring care when the site cannot sustain these controls internally. The transition is complete when evidence and ownership—not optimism—support ongoing normal operations.