Discovering that your website has been hacked is a moment of panic. Your first instinct might be to delete plugins in bulk or change all passwords in a rush. But if you do that right away, you risk erasing clues about how the hacker got in, making a complete cleanup much harder.

Take a deep breath. Here’s a step-by-step guide to handling the situation calmly and effectively, minimizing the damage to your business.

Step 1: Freeze the Scene (and Don’t Panic)

Before touching anything, your goal is to contain the threat and preserve evidence. Think of it as a digital crime scene. The first thing to do is cut off public access so the hacker can’t do more damage. You can do this by putting your site in maintenance mode, using a firewall to block everyone except your own IP address, or asking your host to do it for you. The goal is to stop the infection while keeping an exact copy of what happened.

While you isolate the site, take screenshots of anything that looks abnormal: modified pages, new user accounts you don’t recognize, or strange error messages.

Step 2: Make a Backup of the Infected State

Before cleaning anything, make a full backupA copy of your WordPress site's files and database, saved to... More of your files and databaseWhere all WordPress content, settings, and user data are sto... More as they are right now. This may seem counterintuitive, but it’s crucial. This backupA copy of your WordPress site's files and database, saved to... More is a snapshot that could help a security expert understand how the hacker got in. Keep it in a safe place. If your host offers a server-level “snapshot” feature, this is the perfect time to use it.

Step 3: Contact the Professionals

Even if you’re an experienced user, most small business owners don’t have the skills of a security expert. This is the time to contact your web developer, your agency, or a specialized malware removal service. If you’re using managed hosting, their support team can also assist with the initial steps, like restoring from a server backupA copy of your WordPress site's files and database, saved to... More. A professional cleanup can take between 24 and 48 hours, but it will ensure the job is done right.

Good to know: Over 77% of hacks are due to malware, and over 96% of attacks target WordPress and WooCommerce sites. This means you’re not alone, and solutions exist.

Step 4: Identify the Type of Attack (If Possible)

While waiting for the experts to arrive, try to understand what type of attack it is. This helps target the response. Common signs include:

• Site defacement: Your homepage has been replaced with a message from the hacker.
• Malicious redirects: Visitors are redirected to advertising or malware sites.
• Ransomware: A message demands payment to regain access to your site.
• Phishing: The hacker has created fake login pages to steal your customers’ credentials.
• Distributed Denial of Service (DDoS) attack: Your site is overwhelmed with traffic and becomes inaccessible.

Step 5: Change All Passwords and Secret Keys

While your site is in maintenance mode, start changing all associated passwords. This includes:

• Your hosting and FTP/SFTP accounts.
• All administrator accounts on your WordPress site.
• DatabaseWhere all WordPress content, settings, and user data are sto... More accounts.
• Email accounts associated with your domain.

Make sure each new password is strong and unique (more than 12 characters, with a mix of letters, numbers, and symbols). This is a non-negotiable step to prevent the hacker from returning with the old credentials.

Step 6: Clean the Site or Restore a Clean Backup

This is where you have a choice.

Option A: Restore a clean backupA copy of your WordPress site's files and database, saved to... More (fastest)
If you have a backupA copy of your WordPress site's files and database, saved to... More from before the infection, restoring it is often the quickest solution. However, be cautious: if the security vulnerability isn’t fixed, the hacker can simply attack you again.

Option B: Thorough cleanup
This is the more comprehensive solution. It involves:

1. Updating everything: WordPress, all themes, and all plugins (especially those with known vulnerabilities).
2. Removing malicious files: Scanning every file for suspicious code (like eval, base64_decode) and deleting files you don’t recognize, especially in the wp-content/uploads/ folder.
3. Cleaning the databaseWhere all WordPress content, settings, and user data are sto... More: Removing any malicious code injected into your tables.
4. Reinstalling WordPress files: Replacing the wp-admin and wp-includes folders with clean versions from wordpress.org.
5. Removing unused plugins and themes: Deactivating isn’t enough. You need to delete them completely.
6. Regenerating salt keys: Changing the eight keys in your wp-config.php file to invalidate all active user sessions.

Important note: If you’re cleaning manually, once you’re done, run a new scan with a reputable security pluginSoftware that adds specific features or functionality to a W... More to verify nothing remains. Hackers often leave hidden backdoors.

Step 7: Strengthen Security

Once the site is clean, it’s time to make it more robust. Key actions to implement include:

• Enable two-factor authentication (2FA) for all administrator accounts.
• Install a Web Application Firewall (WAF).
• Disable public access to the xmlrpc.php file.
• Limit login attempts to your adminThe admin (administrator) is the highest user role with full... More interface.
• Set up automatic backups and store them off your server.

Step 8: Communicate and Learn Lessons

If customer data may have been compromised, you have a legal and ethical obligation to inform them. Write a clear and transparent message about what happened and the steps you’re taking to protect them.

Finally, document everything: the date of the attack, how the hacker got in, what you did to remove them, and the new security measures in place. This will help you prepare for a potential next time.

The key takeaway: A hack is a shock, but a calm and methodical response can significantly reduce the damage. Don’t try to do everything alone. Bring in professionals and follow these steps to get back to a safe and secure site.