www.simplify-data.de
Your WordPress website suddenly redirects to strange pages, Google warns about malware, or unknown administrators appear? Then you need to act quickly but carefully. This article shows step by step what to do immediately after a hack and how to secure your website afterwards.
How to recognise a hack
Not every malfunction is an attack. Typical signs of a compromised website include:
- Visitors are redirected to other sites, often only on mobile devices or only when arriving from Google.
- Google, browsers or antivirus software warn about the site.
- Google Search Console reports security issues or unfamiliar pages in the index.
- There are unknown user accounts with administrator rights.
- Your host suspends the site or reports spam being sent from the server.
- Content appears on the site that you did not publish.
Write down what you observe and when. These notes form the basis for further analysis and, where applicable, for reporting obligations.
First steps: limiting the damage
1. Stay calm and document
Record symptoms, times and recent changes to the site, such as new plugins or theme modifications. Take screenshots of warnings. Do not delete files hastily, as they help to understand later how the attacker got in.
2. Put the site into maintenance mode or take it offline
If the site redirects visitors to malicious pages or distributes malware, take it offline temporarily or display a static maintenance page. This protects your visitors and limits damage to your reputation. Your host can often help.
3. Inform your host
On shared hosting, the attack may affect other areas of the server. Your host can provide log files showing when and how access occurred and may have its own backups.
4. Back up the current state
It sounds paradoxical, but back up the infected files and database before changing anything. This copy is not restored; it serves for analysis and as a fallback if something goes wrong during clean-up.
5. Change all credentials
Change every password: WordPress administrators, hosting control panel, FTP or SFTP, database and any email accounts connected to the website. Also renew the security keys in the wp-config.php file. This ends all active sessions, including the attacker's. Review the user list and remove unknown accounts.
Important: change the passwords again after the clean-up. As long as malicious code remains on the server, new passwords could be captured again.
6. Check your own computers
Some attacks start not on the server but on an administrator's computer, for example through malware that steals credentials. Scan the devices you use to access the website.
Cleaning up: backup or rebuild
There are two basic paths back to a clean website.
| Approach | When it makes sense | Keep in mind |
|---|---|---|
| Restore from backup | A clean backup from before the attack exists | Changes and orders since the backup are lost; the vulnerability must still be fixed |
| Manual clean-up | No clean backup, or data loss is not acceptable | Time-consuming, requires experience; hidden backdoors are easily missed |
In a manual clean-up, WordPress core files, plugins and themes are replaced with fresh copies from official sources, in the same version as before. Then the wp-content folder, the .htaccess file and the database are checked for injected code. Attackers often leave so-called backdoors, hidden entry points they can use to return later.
A restore alone is not enough. If the cause, such as an outdated plugin with a known vulnerability, is not fixed, the website will quickly be compromised again.
Data protection: check notification duties
If personal data may have been affected, such as customer data from an online shop, form submissions or user accounts, the rules of the GDPR apply. Under Art. 33 GDPR, a personal data breach must generally be reported to the competent supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to the individuals concerned. If the risk is high, Art. 34 GDPR also requires informing the affected individuals.
Whether a notification is required depends on the individual case. Involve your data protection officer or legal counsel early, as the deadline runs from the moment you become aware of the incident.
After the clean-up: back online
- Update everything: bring WordPress, plugins, themes and the PHP version to a supported state.
- Remove what you do not use: delete deactivated plugins and themes, as they can be vulnerable too.
- Change passwords again and enable two-factor authentication for administrators.
- Inform Google: if Google flagged the site as dangerous, request a review in Search Console.
- Set up monitoring: have availability and file changes monitored.
- Check backups: set up automatic off-site backups and test restores.
- Document the cause: record how the attack probably happened and which measures were taken.
Prevention is cheaper
Most successful attacks on WordPress exploit known vulnerabilities in outdated plugins or themes, or weak credentials. Regular updates, few and well-maintained plugins, strong passwords with two-factor login and working backups prevent a large share of incidents. What cannot be prevented can be fixed much faster with a good backup. Also define who is responsible in an emergency and where credentials and emergency contacts are stored.
How Simplify Data can help
Simplify Data helps businesses in Kiel, Schleswig-Holstein, Hamburg and across Germany clean up hacked WordPress websites and secure them for the long term. Ongoing maintenance, updates and backups reduce the risk of it happening in the first place. Request WordPress maintenance