Hacked WordPress Site Checklist: What to Do First

First steps

Start with control and evidence, not panic.

Take screenshots of warnings, redirects, or spam pages.
Change admin, hosting, FTP, and database passwords if access may be exposed.
Check whether customers can still buy, book, submit forms, or log in safely.
Confirm which backup points exist before making destructive changes.

Cleanup steps

A real cleanup looks beyond the obvious infected file.

Scan files, uploads, themes, plugins, and the database.
Remove unknown admin users and stale accounts.
Replace compromised core files from clean sources.
Patch or remove the vulnerable plugin, theme, or access path.
Review the site after cleanup for reinfection.

After cleanup

Submit review requests if Google, browsers, antivirus tools, or hosting vendors flagged the site. Then add monitoring so the next warning is caught earlier.

Hacked WordPress Site Checklist: What to Do First: comparison table

Use this table to compare the options by business impact, not by feature count. The strongest choice is the one that protects the login, checkout, forms, browser warnings, search listings, and customer trust signals and gives the site owner a clear owner when something goes wrong.

Decision point

Light support

Full care plan

Best fit

Lower-risk sites where the site owner can tolerate slower help or handle part of the routine internally.

Business-critical sites where malware warnings, reinfection, stolen access, downtime, and loss of trust would affect revenue, trust, or daily operations.

What it usually owns

A narrow slice of the security and recovery process: one task, one platform layer, or one person responding when available.

The ongoing health of the security and recovery process, including prevention, response, recovery, and customer-path checks.

Where it can fall short

The support gap appears when a problem crosses boundaries, such as hosting, plugins, security, email, payment, or content workflow.

The main risk is choosing a plan with vague scope. The provider should say plainly what is included and what becomes project work.

Best buying question

Ask, "What happens if this breaks while customers are trying to use the site?"

Ask, "Who owns the fix, how fast do they respond, and how do they stop it happening again?"

Customer impact

The customer impact may be indirect. The site owner may still need to coordinate between tools, vendors, and support queues.

The customer impact is part of the service model. The provider should understand why the issue matters to sales, leads, bookings, access, or trust.

Recovery quality

Recovery often depends on whether the right backup, credentials, notes, and specialist are available at the right moment.

Recovery should be planned before the incident: known restore points, rollback process, clear escalation, and post-incident prevention.

When to choose each option

The right answer depends on how much the site matters to customers. A low-risk brochure site can accept a lighter setup. A site that creates sales, leads, bookings, members, or support tickets needs stronger ownership.

Choose the lighter option when the site is low risk

If the site is mostly informational, traffic is modest, and a short outage would not damage the business, a lighter setup can be enough. The site owner still needs backups, updates, and a way to get help, but the response level can be simpler.

Choose ongoing care when customers depend on the site

If customers use the login, checkout, forms, browser warnings, search listings, and customer trust signals, ongoing care is the safer default. The job is not just to keep WordPress updated. The job is to keep the customer experience working.

Choose specialist support when money or trust is at stake

If the likely failure creates malware warnings, reinfection, stolen access, downtime, and loss of trust, the provider should understand that as a business incident. This is where a specialist care plan is usually worth more than occasional fixes.

Choose project work for major new features

Care plans are not a blank check for redesigns, custom software, or major rebuilds. Keep ongoing care separate from larger project work so support stays fast and the scope stays honest. That boundary protects both sides: the site owner gets reliable support, and the provider can respond quickly without every ticket becoming a mini rebuild.

Common mistakes to avoid

Comparing providers by checklist length instead of asking who owns the login, checkout, forms, browser warnings, search listings, and customer trust signals.
Buying the cheapest plan for a site that customers use to pay, book, log in, or contact the business.
Assuming backups are useful without asking how restores are tested and who performs them.
Letting automatic updates touch high-risk plugins without a rollback plan.
Treating security, performance, email, hosting, and support as separate problems with no clear owner.
Waiting until customers complain before checking whether the site is actually working.
Forgetting that malware warnings, reinfection, stolen access, downtime, and loss of trust are business problems, not just technical annoyances.

What a good operator would watch

A good operator does not only ask whether the website loads. They ask whether the site is still doing its job for the business. For this topic, that means watching the login, checkout, forms, browser warnings, search listings, and customer trust signals.

The clearest sign of a mature setup is boring consistency: known backups, safe update routines, plain support scope, clear escalation, and evidence that the important paths were checked after risky changes.

A weak setup usually feels fine until the first awkward incident. The site owner then has to remember who built the site, who hosts it, which plugin controls the broken workflow, where backups live, and whether anyone is available. That is the hidden cost a care plan is meant to remove.

For Superpress-style care, the goal is not to make the customer learn more WordPress. The goal is to give the admin a calm path: report the business symptom, let the care team trace the technical cause, and get the site back to a trustworthy state.

What changed recently, and did anyone test the customer path afterwards?
Can the site be restored without losing important orders, leads, users, or content?
Who receives the alert when something breaks, and who is responsible for the first response?
Which issues are covered by the care plan, and which issues become separate project work?
Is there a written history of past incidents, fixes, plugin changes, and hosting changes?
Would a non-technical admin know what to send support if the same problem happened tomorrow?
Does the provider explain WordPress care plans in plain business language, or only in technical feature lists?

Frequently asked questions

Should I take a hacked WordPress site offline?

If customers are being redirected, exposed, or warned away, a temporary maintenance page may be safer while cleanup happens.

Why does WordPress malware come back?

Usually because a backdoor, vulnerable plugin, weak account, or infected database entry was missed during cleanup.

Quick answer summary

/ Short answer

If your WordPress site is hacked, preserve evidence, protect admin access, check backups, identify customer impact, remove malware, close the entry point, and request review from Google or security vendors if warnings appear.

/ What matters most

Do not randomly delete files before you understand the incident.
The cleanup must remove malware and close the original entry point.
Customer trust matters: checkout, forms, emails, and search warnings need attention.

/ Best next step

Match the support level to the real customer impact: leads, sales, bookings, logins, security, recovery, and trust. If the site creates money or customer confidence, choose ongoing care over occasional fixes.

/ Related Superpress pages

WordPress care plans Compare pricing