← Rescuing a Failing WordPress Project
What do you do first when WordPress is hacked?
Contain it and back everything up exactly as you found it before changing or deleting anything. Investigating a compromise requires evidence, and deleting files or restoring a backup before you understand how the attacker got in just means the same entry point is still open when you’re done cleaning up.
Containment and investigation
The instinct to immediately delete anything that looks malicious is understandable and wrong. Investigating first (what was modified, when, and how) is what tells you whether you’re looking at a defaced page or a backdoor that will let the attacker back in the moment you finish cleaning. Containing the site (taking it offline or restricting access if needed) buys time to investigate properly without the compromise actively getting worse while you work.
Cleaning core, plugins, and themes
Once the investigation is done, cleanup means comparing every WordPress core, plugin, and theme file against a known-good version and removing anything that doesn’t match, not just deleting the obviously suspicious files and hoping that was everything. Malware has a habit of leaving more than one way back in, so a partial cleanup that misses a second backdoor just means the same compromise resumes later.
Closing the entry point
Cleaning the infection without fixing what let the attacker in means the same compromise happens again, often quickly. That means finding and fixing the actual vulnerability, whether it was an outdated plugin, a weak credential, or something else, not just treating the symptoms.
Hardening after
A cleaned site with the same weaknesses that got it hacked the first time is a site waiting to get hacked again. See keeping a WordPress site stable after a rescue for the hardening, monitoring, and update discipline that actually prevents a repeat incident.
Real example
84EM carried out a structured security remediation and modernization that resolved every vulnerability identified in a security audit, reorganized a sprawling codebase into maintainable sections, and removed unnecessary legacy features and outside dependencies. For an organization needing protection without touching the existing site at all, 84EM also built automated security hardening for a healthcare research organization that achieved an A+ security rating with zero changes to the site itself.
Talk to 84EM about remediating a hacked WordPress site if your site has been compromised.
