WordPress security and recovering a hacked site

WordPress security begins before anything goes wrong. But if you are currently facing a hacked site, you first want to know what is expected of you. This page answers both questions: what to do when things have already gone wrong, and how to be better prepared afterwards. For each subtopic we refer to the article containing the full detail.

Are you in the middle of an incident? Read the section below before you touch anything.

Orientation: which article do you need?

Situation	Relevant section
My site has been hacked right now	Acute situation, recovery process, costs
I suspect my site may be infected	Recognising the signs, malware checking
I want to prevent it	Prevention, 2FA, firewall, plugins, login security
I want to understand how it happened	Causes, access routes, platform safety
I am choosing between tools and management	Plugin vs hardening, choosing a security plugin

The acute situation

When you discover your site has been hacked, the first impulse is to log in and fix things yourself. Understandable. But it destroys the traces needed to establish how the attacker gained access. Without that answer you cannot close the gap, and the infection returns. What you should do in the first hours, and why certain actions make the investigation harder, is covered in My WordPress site has been hacked: what now?

Recognising whether your site is infected

Not every hack is immediately visible. In practice, owners tend to notice a redirect to another site, visibly infected pages, reports from visitors, or a signal via Search Console. How to recognise the signs is covered in How do you recognise if your WordPress site has been hacked?

Checking for malware

Do you suspect an infection? Then you can run a scan. What such a scan reveals and why your own check never provides the full picture is covered in How do you check your WordPress site for malware?

Removing malware

Removing malware yourself seems like a logical step. But in many cases it destroys the traces needed to find the access route. Why that is problematic, what should happen instead, and when a clean reinstallation makes more sense than combing through files, is covered in How do you remove malware from a WordPress site?

The cost of recovery

Recovery is a cost-benefit consideration. For a smaller site it may be more sensible to export the content and rebuild from scratch than to keep searching. Where the costs come from and when the balance tips is covered in What does it cost to recover a hacked WordPress site?

Causes: why it went wrong

In our experience, an outdated plugin is the access route in approximately 75 per cent of cases. Not the WordPress core itself. Other access routes include weak passwords and FTP credentials that have never been changed. If you want to understand the cause before making any changes, that is covered in Why do WordPress sites get hacked?

Preventive measures

Once the site is clean, the process shifts from defence to offence. Which measures genuinely make a difference and where their limits lie is covered in How do you secure WordPress preventively?

Choosing the right security plugin

A properly configured security plugin such as Wordfence contributes to WordPress security. But running two plugins side by side delivers less, not more: they conflict and cost performance. If you want to know which plugin suits your situation, including why only one should be running at a time, that is covered in Which WordPress security plugin should you choose?

Plugin versus structural maintenance

Tooling is not a substitute for maintenance. If you are wondering whether a security plugin is enough or whether structural measures carry more weight, you will find the practical assessment in WordPress security plugin vs hardening: what works?

Two-factor authentication

Two-factor authentication makes it significantly harder for an attacker to gain access with stolen credentials. What it does, why it matters, and where to activate it is covered in How do you set up 2FA in WordPress?

Login security

Limiting failed login attempts catches brute-force attacks. However, it does nothing against the most common access route via vulnerable plugins. What this measure does and does not do is covered in How do you limit failed login attempts in WordPress?

Changing the wp-admin URL

Moving the default login page reduces visibility for automated scans. But it does not change the vulnerabilities that attackers actually exploit. What this adjustment does and does not achieve is covered in How do you change the wp-admin URL in WordPress?

What a firewall does

A firewall in WordPress filters suspicious traffic before it reaches the site. It has a clear limitation: it does not protect against vulnerabilities in code that is already on the server. What a WordPress firewall actually does and where it stops is covered in What is a firewall in WordPress?

The safety of the platform

The risks of WordPress security do not lie in the core of the platform, but in the ecosystem around it: plugins, themes, and everything that is not maintained. Whether that is a reason to choose a different platform, and what the answer is to the question of whether WordPress is secure enough, is covered in How secure is WordPress? More background on the platform itself can be found on the WordPress overview page.

Frequently asked questions

What should I do the moment I discover my site has been hacked? Touch as little as possible. Logging in, deleting files or updating plugins destroys the traces needed to establish how the attacker gained access. Without that information you cannot close the gap, and reinfection is likely. Bring in someone who can carry out the investigation as quickly as possible.

Can my site be recovered if I can no longer access the backend? Yes. Access to the WordPress backend is not required for recovery. Via the hosting environment or at server level there is almost always a way in. The absence of backend access slows the process but rarely makes it impossible.

How long does it take to recover a hacked WordPress site? Most sites are back online within a day. That is based on experience, not a guarantee. Determining factors include whether there is an SLA in place, the available capacity at that moment, the size of the site, and whether integrations have been affected. With an SLA, action is taken within four hours in the event of an emergency.

Is my site definitively clean after recovery? At handover the site is clean. Recurrence can never be entirely ruled out, particularly if no structural maintenance follows. In practice, reinfection rarely occurs when the access route has been closed and periodic maintenance is carried out afterwards.

What happens if customer data has been stolen? Legal follow-up is then required. The Information Commissioner’s Office (ICO) is the relevant authority in the United Kingdom. The rules in this area change, and their interpretation differs depending on the situation. Consult a solicitor for tailored advice.

Does a security plugin prevent my site from being hacked? A well-configured security plugin reduces the risk but does not eliminate it. A plugin does not protect against vulnerabilities in code it does not recognise or that are already active at the time of installation. The combination of up-to-date maintenance and a security plugin provides more protection than tooling alone.

A hacked site or a site you want to better secure calls for a concrete assessment, not more plugins or a longer checklist. It becomes specialist work the moment the stakes are too high for a standard solution: when customer data has been lost, in the event of repeated infection, or for a site that is business-critical. What we do in this area is described at WordPress support and maintenance.