What to do first when your WordPress site is compromised

A calm, practical first-response checklist before you start deleting files or reinstalling plugins.

1. Stabilize the situation

If you can, place the site in maintenance mode or temporarily restrict access. Avoid repeatedly reinstalling plugins or deleting unfamiliar files before you understand what changed. If the site is redirecting visitors or distributing spam, reduce exposure while you investigate.

2. Secure the access points

Change the passwords for hosting, WordPress administrators, SFTP/FTP, and the database where appropriate. Review administrator users and remove accounts you cannot verify. Use a clean device when changing credentials, and turn on multi-factor authentication where supported.

3. Preserve a backup for investigation

Save a copy of the current files and database before cleanup. It may contain clues about the compromise. Do not treat a backup as clean until it has been checked; otherwise the same malicious code may be restored later.

4. Clean, update, and verify

Inspect modified files, remove malicious code, update WordPress and extensions, and review file permissions. Then check redirects, forms, admin accounts, search results, and security logs. Verification matters because a normal-looking homepage does not prove that every malicious file is gone.

5. Reduce the chance of a repeat

Use unique credentials, remove unused plugins and themes, keep reliable backups, and monitor for unexpected changes. The best recovery includes a prevention plan, not only a clean homepage.