{"slug":"wordpress-hacked-site-recovery","title":"WordPress Hacked Site Recovery","tags":["security","malware","recovery","hardening"],"agent_summary":"Nine-step procedure to clean a compromised WordPress site and harden it against reinfection.","trigger_phrases":["wordpress hacked","wordpress malware","compromised wordpress","clean wordpress site","wordpress recovery"],"runnable":false,"markdown":"\nNine steps to recover a hacked WordPress site. Do not skip steps — hackers plant backdoors that survive partial cleanups.\n\n## Step 1 — Back Up First\n\nBack up files and database before touching anything. Even a hacked backup is useful for forensics.\n\n## Step 2 — Replace WordPress Core\n\n1. Download latest WordPress from https://wordpress.org/latest.zip\n2. Extract. Do NOT overwrite `wp-config.php` or `wp-content/`.\n3. Replace: all root PHP files, `wp-admin/`, `wp-includes/` with clean copies.\n\n## Step 3 — Manual Malware Scan\n\nSearch for common injection patterns:\n\n```bash\ngrep -rl \"base64_decode\" /path/to/wordpress/\ngrep -rl \"eval(\" /path/to/wordpress/\ngrep -rl \"gzinflate\" /path/to/wordpress/\n```\n\nSuspicious folders in `wp-content/plugins/` should be moved out of web root and reviewed, not deleted immediately.\n\n## Step 4 — Rotate All Credentials\n\n- Change FTP/SFTP passwords\n- Change all WordPress user passwords\n- Remove users who should not have access\n- Regenerate wp-config.php salts at https://api.wordpress.org/secret-key/1.1/salt/\n\n## Step 5 — Update All Plugins\n\nUpdate every plugin. Delete abandoned or unused plugins. Outdated plugins are the most common entry point.\n\n## Step 6 — Install All In One Security (AIOS)\n\nConfigure firewall rules, login lockdown, and file change detection. Replaces default login URL protection.\n\n## Step 7 — Hide the Login URL\n\nInstall WPS Hide Login. Change `/wp-admin` and `/wp-login.php` to a custom path. Bookmark the new URL.\n\n## Step 8 — Deep Scan with WP Cerber\n\nWP Cerber compares installed plugin/theme files against original author zips. Any modified file is flagged. For premium plugins, upload the original vendor zip to Cerber manually so it can compare.\n\n## Step 9 — Consider Sucuri WAF\n\nSucuri's Web Application Firewall blocks attacks before they reach the site. Includes automated malware scanning and remediation. Recommended for clients who want hands-off ongoing security.\n\n## Why Restoring a Backup Isn't Enough\n\nHackers often inject code days or weeks before exploiting it. A backup restore may restore the infection. Always run the full scan pipeline even after restoring.\n","html":"<p>Nine steps to recover a hacked WordPress site. Do not skip steps — hackers plant backdoors that survive partial cleanups.</p>\n<h2>Step 1 — Back Up First</h2>\n<p>Back up files and database before touching anything. Even a hacked backup is useful for forensics.</p>\n<h2>Step 2 — Replace WordPress Core</h2>\n<ol>\n<li>Download latest WordPress from https://wordpress.org/latest.zip</li>\n<li>Extract. Do NOT overwrite <code>wp-config.php</code> or <code>wp-content/</code>.</li>\n<li>Replace: all root PHP files, <code>wp-admin/</code>, <code>wp-includes/</code> with clean copies.</li>\n</ol>\n<h2>Step 3 — Manual Malware Scan</h2>\n<p>Search for common injection patterns:</p>\n<pre><code class=\"language-bash\">grep -rl \"base64_decode\" /path/to/wordpress/\ngrep -rl \"eval(\" /path/to/wordpress/\ngrep -rl \"gzinflate\" /path/to/wordpress/\n</code></pre>\n<p>Suspicious folders in <code>wp-content/plugins/</code> should be moved out of web root and reviewed, not deleted immediately.</p>\n<h2>Step 4 — Rotate All Credentials</h2>\n<ul>\n<li>Change FTP/SFTP passwords</li>\n<li>Change all WordPress user passwords</li>\n<li>Remove users who should not have access</li>\n<li>Regenerate wp-config.php salts at https://api.wordpress.org/secret-key/1.1/salt/</li>\n</ul>\n<h2>Step 5 — Update All Plugins</h2>\n<p>Update every plugin. Delete abandoned or unused plugins. Outdated plugins are the most common entry point.</p>\n<h2>Step 6 — Install All In One Security (AIOS)</h2>\n<p>Configure firewall rules, login lockdown, and file change detection. Replaces default login URL protection.</p>\n<h2>Step 7 — Hide the Login URL</h2>\n<p>Install WPS Hide Login. Change <code>/wp-admin</code> and <code>/wp-login.php</code> to a custom path. Bookmark the new URL.</p>\n<h2>Step 8 — Deep Scan with WP Cerber</h2>\n<p>WP Cerber compares installed plugin/theme files against original author zips. Any modified file is flagged. For premium plugins, upload the original vendor zip to Cerber manually so it can compare.</p>\n<h2>Step 9 — Consider Sucuri WAF</h2>\n<p>Sucuri's Web Application Firewall blocks attacks before they reach the site. Includes automated malware scanning and remediation. Recommended for clients who want hands-off ongoing security.</p>\n<h2>Why Restoring a Backup Isn't Enough</h2>\n<p>Hackers often inject code days or weeks before exploiting it. A backup restore may restore the infection. Always run the full scan pipeline even after restoring.</p>\n"}