Your site is hacked: what to do in the first 24 hours

0–15 minutes: protect access before you touch files

Stop the attacker from using the access they already hold. Keep the record intact.

1. Photograph the screen and note the time, URL and what you saw.
2. Use a clean device. Do not open links from the warning email.
3. Change passwords on host, registrar, WordPress, SSH and database; use a manager.
4. Turn on two-factor, log out all WordPress sessions, and reset the wp-config salts.
5. Open a security ticket with your host. Ask them to preserve logs and check other sites.
6. Do not restore a backup or run a cleaner yet. Both can destroy evidence.

15–60 minutes: brief the people who can suspend, restore or refund

Make sure the people with leverage know, and that a copy exists off-server.

1. Tell your host. If malware is live, serve a 503 page and keep the logs.
2. Lock the registrar: password, transfer lock, two-factor and DNS records.
3. Download the web root, database and raw logs; store them encrypted, off-server.
4. Tell your payment provider; ask them to watch for fraud.
5. Check mailbox forwarding rules, which can keep password resets working.
6. Log each action with a time for the host, insurer and any regulator.

1–4 hours: find the entry point before you clean

The entry point usually shows up in the user list, file timestamps or the access log.

1. Screenshot and export admin users; disable accounts you did not create.
2. Compare core, theme and plugin files with checksums or fresh downloads.
3. List PHP files in uploads and cache; there should be none.
4. Read the access log around wp-login, xmlrpc, admin-ajax and random filenames.
5. Check cron, mu-plugins and drop-ins; scanners often ignore them.
6. Check Search Console and Bing warnings; do not request review until clean.

4–24 hours: clean or rebuild, then verify

If you cannot name the entry point, do not clean and hope. Rebuild on clean infrastructure.

1. Clean: replace core, themes and plugins from official sources; delete unknown files and users.
2. Rebuild: fresh install, content-only import, new credentials, no unexplained plugins.
3. Verify with a second scanner, an integrity check, a spam crawl and a test order.
4. Request search reviews only after verification; expect days, not minutes.
5. Decide notifications with counsel before you email customers.
6. Watch logs daily for 30 days; reinfection means the entry point is still open.

Do not delete the site: what to preserve, and why

Deleting the site feels decisive. It also destroys the record of how the attacker got in, which a rebuild needs. A rebuild that keeps the entry point, the old password or hosting account tends to be reinfected.

Preserve these before cleaning, for at least a year if personal or card data is involved:

• Raw web, FTP/SSH and mail logs, which hosts rotate within days.
• A web-root archive with timestamps and suspect file hashes.
• A database dump including wp_users, wp_options and WooCommerce order tables.
• The admin list with registration dates and roles.
• A plugin and theme inventory with versions, active status and disabled ones.
• .htaccess, wp-config, cron, mu-plugins and drop-ins.

If files are encrypted and a ransom is demanded, read CISA's StopRansomware guide before paying. Paying funds the next attack.

Clean or rebuild: how to decide

Clean when the cause is known and contained. Rebuild when the entry point is unknown or hosting was compromised.

Cleaning usually takes hours to two days; a rebuild, three to ten business days. A rebuild that repeats the cause is the expensive option.

What a clean has to include

A zero from a scanner is a starting point, not a clean. A defensible clean covers five areas:

• Backdoor sweep: compare all files with official checksums; read mu-plugins, drop-ins, cron and .htaccess; list PHP in uploads.
• User audit: remove unknown accounts, reset passwords, revoke sessions, require two-factor for admins.
• Secret rotation: database, salts, payment, SMTP, CDN, DNS, webhooks and API keys.
• Plugin inventory: remove inactive and abandoned plugins, replace nulled copies, update the rest.
• Hardening pass: least-privilege database user, disabled file editing, login limits, a WAF and supported PHP. The WordPress hardening guide is the baseline.

Record what was checked and what was not. A clean scan is not proof no backdoor remains.

Prevention checklist for the next 30 days

Not a perfect security programme: it removes the conditions that make a small site an easy target.

• Day 1: two-factor on WordPress, host, registrar and email; unique passwords.
• Day 1: update core, theme and plugins; delete unused ones.
• Day 2: offsite backups, daily if you take orders, with one restore test.
• Day 3: WAF, login limits, disabled file editing, no "admin" user.
• Day 7: remove unused FTP/SSH accounts and keys; one login per person.
• Day 30: review users, integrations and API keys with a name and a date.

Three items would have prevented many of the cases in this guide: weekly patching, unique passwords plus two-factor on every admin entry point, and an offsite backup you have restored once. None of them makes the site safe, but they remove the cheapest ways in.

For stores, work through the WooCommerce security checklist. If you are weighing maintenance, what WordPress maintenance costs sets out the hours and failure modes.

Where Keelpost fits, and where it does not

We are a small studio, not an emergency hotline. Support runs 09:00–18:00 GMT+8, Monday to Friday; we are not a 24/7 SOC. At 2am, your host is the faster call.

Next business morning, we can run a fixed-scope security audit from $490 in 3 business days: access, users, plugins, configuration and logs, with a fix list. Care plans from $129/month cover updates, backups and monitoring. We do not hold ISO 27001 or SOC 2; the trust page says so, and we will not promise the site cannot be hacked again.

We do not provide legal advice, court-grade forensics or a 24/7 watch. If card data was exposed, your acquirer's process comes first. See what the security audit and care plans cover.