iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you suspect a WordPress backdoor, do not immediately overwrite the site with the newest backup. First document what changed, preserve the current state when practical, and ask your hosting provider whether the compromise reaches other sites or account services. Then identify a backup that predates the earliest plausible intrusion and contains both the site files and database. Restore the files first and the matching database second, rotate every potentially exposed credential, replace WordPress authentication keys, remove the vulnerable entry point, and validate the account for persistence. A successful restore alone does not prove that the attacker’s access or the original weakness is gone.
Use the host’s incident team or a qualified security specialist if you cannot establish a clean restore point, malware returns, multiple sites are affected, or server-level logs and account areas are outside your control.
What should I do first if I think my WordPress site was hacked?
Start with documentation and coordination, not deletion. WordPress.org’s hacked-site guidance states: “The first actionable step you should take post-compromise is documentation.” Record the symptoms, timestamps and time zone, recent changes, and hosting setup before making changes that could destroy evidence.
Record the signs and timeline
- Write down the first time you noticed redirects, spam pages, changed content, defaced pages, new administrator accounts, browser warnings, unusual downloads, or a host suspension.
- Save screenshots and the exact affected URLs, including whether the problem appears for logged-in users, visitors, or only search engines.
- List plugin, theme, WordPress, DNS, hosting, and password changes made shortly before the incident.
- Note whether email, FTP/SFTP, SSH, cron jobs, control-panel users, or other sites share the account.
Unrecognized users, security warnings, unauthorized visible changes, and a hosting provider disabling the site are among the indicators described by the WordPress.org hacked-site FAQ.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Contact the host before restoring
Tell the provider that you suspect an account compromise and ask whether other domains, databases, mailboxes, control-panel users, or server services show related activity. On shared hosting, malicious files or stolen credentials may exist outside the affected WordPress directory. Ask what snapshots, logs, quarantine tools, and full-account recovery options are available, and request that relevant logs be retained.
Preserve a reference copy
When your host permits it, preserve a snapshot or archive of the current files and export the current database before cleanup. Keep it isolated and clearly label it as potentially infected. Even an infected copy can help a specialist compare timestamps, identify the entry point, or determine whether a backdoor survived a restore. Do not execute unknown scripts from the archive.
How do I know whether a WordPress backup is complete and clean?
A usable WordPress restore normally requires two coordinated parts: the site files and the database. The database holds posts, pages, settings, users, comments, and other structured content; files hold WordPress core, plugins, themes, uploads, configuration, and other code. A file-only copy cannot recreate the database, and a database-only export cannot recreate executable files.
Check the backup’s date against the compromise
Select a snapshot believed to predate the earliest plausible intrusion, not merely the most recent file available. A backup created after the attacker entered may preserve the backdoor. cPanel’s compromised-account guidance recommends a pre-compromise backup and warns that restoring without repairing the original vulnerability can expose the site again; Namecheap gives the same warning about post-compromise backups.
Confirm scope and consistency
For every candidate snapshot, ask the host or backup system:
- What exact date, time, and time zone does it represent?
- Does it include both files and database, and are they from a compatible point in time?
- Are uploads, custom themes, must-use plugins, configuration files, and rewrite rules included?
- Does it cover only one site or the entire hosting account?
- How was the snapshot created, and can it be mounted or inspected without replacing the live site?
“A backup exists” is not the same as “the backup is clean.” If the account may contain malware outside the site directory, discuss a full-account recovery with the host rather than assuming a partial WordPress restore is sufficient. The cPanel guidance and Namecheap’s hacked-account guidance both emphasize this broader assessment.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Which recovery method should I choose?
Choose the narrowest method that still removes the attacker’s access. Compare the options against the backup’s age, scope, the likely entry point, and your ability to validate the whole account.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Recovery method | When it fits | Main risk | Questions to answer first |
|---|---|---|---|
| Full account restore | Several sites or account services may be affected, or the host can provide a verified pre-compromise snapshot. | Recent legitimate data may be lost; restoring an unclean account snapshot reproduces the compromise. | Does the snapshot predate the earliest indicator, and will the host inspect account-level persistence? |
| Complete WordPress restore | One site is affected and a matched files-plus-database backup is available. | The original vulnerable plugin, theme, credential, or server path may still be open. | Can you identify and repair the entry point, then rotate all exposed access? |
| Partial restore | Affected components are known and the remainder contains essential newer data that cannot be discarded. | Hidden web shells or altered files can remain outside the selected directories. | Has the host or specialist checked every executable location and the database for persistence? |
| Manual cleanup | No trustworthy backup exists and the site’s content must be preserved. | It is easy to miss obfuscated code, rogue users, scheduled tasks, or server-level access. | Can you compare every file with trusted originals and obtain server logs? |
| Host-led or specialist recovery | Malware returns, the entry point is unknown, multiple sites are involved, or the account is shared. | Cost and downtime; the provider may have limits on forensic detail. | What evidence will be preserved, what scope will be checked, and how will the repaired weakness be verified? |
No single method is correct for every incident. The decision criteria above follow the distinctions in the WordPress backup documentation and hosting-provider recovery guidance.
How do I restore a clean WordPress backup safely?
Use a matched, pre-compromise set and perform the file restore before the database import, which is the typical order in WordPress’s backup documentation. The exact buttons differ by host, so obtain the provider’s procedure before putting the site into maintenance mode.
- Prepare a maintenance window. Tell stakeholders when the site may be unavailable. Preserve the current state and export any newly created orders, comments, uploads, or other records that must be retained and later reconciled.
- Restrict access while working. Use the host’s maintenance, quarantine, or temporary access controls. If the provider has disabled the account, do not re-enable it until they advise that the restore can be performed safely.
- Verify the restore point again. Confirm the timestamp, files-plus-database scope, and whether the backup predates the earliest plausible compromise. Do not use an archive merely because its filename says “backup.”
- Restore the site files first. Replace the WordPress core,
wp-admin,wp-includes, plugins, themes, uploads, and other site files from the selected set. Keep a copy of the old directory outside the web root if the host can do so safely; do not leave executable infected files where the server can run them. - Import the corresponding database. Use the host’s database tool or command-line method to import the database from the same restore point. A database from a different period can reintroduce compromised users, settings, or content and can conflict with the restored files.
- Reconcile database credentials. If the database name, user, password, or host changed during recovery, update
wp-config.phpto match the new values. Protect the file with the host’s recommended permissions and keep the database password out of public documents. - Test the basic site before updating. Load the home page, several old posts, the login screen, media URLs, forms, and the administrative dashboard. Check that the restored theme and plugins match the versions represented by the backup and note any errors before changing software.
- Keep the site restricted until access is rotated. A restored site may still accept an attacker’s old session or stolen hosting credential, so do not treat the first successful page load as the end of recovery.
WordPress’s technical instructions describe the general files-then-database sequence; your host’s control panel, database engine, and backup format determine the exact commands and screens.
How do I remove the backdoor and stop the attacker from returning?
After the clean set is running, close every route that may have been exposed and repair the weakness that allowed entry. A restore without these actions can be followed by reinfection.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rotate every potentially exposed credential
- Change every WordPress administrator and editor password, beginning with the account used during the incident.
- Change the hosting control-panel password and remove unknown control-panel users, API tokens, and recovery addresses.
- Change database, email, FTP/SFTP, SSH, deployment, DNS, and server-management credentials or keys that could have been read from the site or account.
- Replace WordPress authentication keys and salts in
wp-config.php. This invalidates existing login cookies, including sessions an attacker may have stolen. - Use unique, long passwords and multi-factor authentication wherever the host and WordPress roles support them.
WordPress.org advises changing passwords again after confirming the site is clean. Changing them only once, before the attacker’s code is removed, risks exposing the new values again.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Remove unauthorized identities and persistence
Review all WordPress users, their roles, registration settings, application passwords, and recovery email addresses. Delete accounts you cannot explain and reset legitimate users’ credentials. Ask the host to inspect control-panel users, SSH keys, FTP accounts, mail-forwarding rules, cron jobs, scheduled tasks, and other account-level locations. Examine .htaccess, web-server configuration, theme and plugin directories, upload directories, and unusual files with recent timestamps.
Repair the vulnerable component
Identify whether the initial access could have come from an outdated plugin, theme, WordPress core, stolen credential, insecure file permission, exposed development copy, or hosting account. Update WordPress, themes, and plugins from trusted sources after the restored site is stable. Replace a modified plugin or theme with a clean package rather than assuming an update will overwrite every extra file, and remove software that is no longer maintained or needed.
The WordPress.org FAQ, cPanel guidance, and Namecheap guidance all stress investigating and correcting the cause. If you cannot explain the entry path, say so explicitly and have the host or a qualified specialist review logs and the wider account.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How can I verify that the restored site is clean?
Validation is a set of checks, not one green scanner result. WordPress.org describes remote and application-level scanning and notes that no single solution is best by itself. Use scanners as evidence alongside file, account, log, and behavior review.
Run file and application checks
- Compare WordPress core files with the official version used by the restored site.
- Inspect plugins and themes for unexpected files, altered timestamps, obfuscated code, and code that loads remote content or creates users.
- Review uploads and writable directories for executable files that do not belong there.
- Check the database for unknown administrators, altered options, injected links, scheduled actions, and unexpected redirects.
- Review server, access, error, login, FTP/SFTP, SSH, and control-panel logs around the first observed indicator.
Wordfence’s cleanup documentation describes comparing files with original repository copies and repairing changed files; that is vendor guidance, not independent testing, so treat it as one technique rather than proof of complete cleanup.
Test from more than one perspective
- Open the site in a clean browser session and from a separate network; check both HTTP and HTTPS versions.
- Test logged-out pages, administrator login, password reset, forms, media, feeds, XML sitemaps, and redirects.
- Check that no unexpected users, scheduled jobs, outbound mail, or new files appear while the site is idle.
- Ask the host to monitor for repeat requests to known malicious paths or sudden file changes after the restore.
If any suspicious behavior returns, stop treating the site as recovered. Preserve the new evidence, restrict access, and escalate rather than repeatedly restoring the same snapshot.
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
What should I do if malware returns or I cannot find a clean backup?
Repeated reinfection or an unknown entry point indicates that the incident scope is larger than a simple file replacement. Ask the host to examine the whole account, isolate neighboring sites where appropriate, preserve logs, and determine whether server or control-panel credentials were compromised.
When no trustworthy snapshot exists
Have a specialist perform a documented manual cleanup while preserving the current state. They should compare core, plugin, and theme files with trusted originals; inspect the database, uploads, rewrite rules, scheduled tasks, users, and account services; and explain which evidence supports the proposed entry point. Make a fresh backup only after validation, and keep copies offline and off-site.
When several sites share the account
Do not clean only the visibly defaced domain. Request an inventory of every site, database, mailbox, user, key, and scheduled task in the account. A full-account recovery may be safer than piecemeal replacement if the provider cannot establish which directories were untouched.
WordPress.com versus self-hosted WordPress
WordPress.com customers should follow the platform’s support, activity-log, and security-tool instructions; its guidance was last reviewed October 20, 2026, and applies to hosted WordPress.com sites. A self-hosted WordPress.org installation must use its own hosting provider’s controls, backups, and incident process. The two environments do not expose the same filesystem or account settings.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I prevent another WordPress backdoor?
Prevention combines recoverable backups, timely maintenance, least privilege, and monitoring. Build the process before the next incident so an attacker cannot alter every copy of your recovery data.
Recommended Free Tools
Maintain independent backups
- Keep separate copies of the database and files, and regularly verify that each pair can be restored together.
- Retain at least one copy on a local computer or external drive and another in a separate location; WordPress recommends separate backup copies, including a local copy, in its backup documentation.
- Protect backup storage with separate credentials and limited write access so a compromised hosting account cannot delete every snapshot.
- Record retention periods, time zones, restore scope, and the procedure for exporting new content before a rollback.
- Perform a test restore in an isolated location, not only a file-existence check.
Reduce the attack surface
- Remove unused plugins, themes, administrator accounts, FTP users, SSH keys, and application passwords.
- Apply WordPress, plugin, and theme updates through trusted sources, and monitor abandoned components.
- Use separate accounts for daily editing and administration, with the lowest role that completes the task.
- Require multi-factor authentication for hosting and administrator access where available.
- Review file-change alerts, login history, new users, redirects, and outgoing mail for anomalies.
Backups are a recovery control, not malware protection. They must be paired with vulnerability repair and credential hygiene.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
What mistakes make a WordPress restore unsafe?
- Restoring the newest snapshot automatically: it may have been created after compromise. Establish the earliest plausible intrusion first.
- Restoring only the files: malicious users, options, and content can remain in the database.
- Restoring only the database: altered plugins, themes, core files, and web shells can remain on disk.
- Leaving old credentials active: an attacker with a valid cookie, password, key, or token can return to a perfectly restored site.
- Updating before preserving evidence: overwritten files and logs can make the entry point harder to determine.
- Assuming a scanner proves cleanliness: scanners can miss server-level persistence, unknown obfuscation, or account services outside WordPress.
- Ignoring the hosting account: a WordPress directory may be only one part of a compromised shared account.
- Declaring success after the home page loads: redirects, scheduled tasks, rogue users, and outbound mail may not appear on the front page.
When should I hand the incident to a professional?
Escalate immediately when the host reports multiple affected sites or services, the account is suspended, you cannot identify a pre-compromise files-and-database set, sensitive data may have been accessed, or malware returns after a restore and credential rotation. Ask for a written scope: systems examined, evidence preserved, files repaired or replaced, credentials invalidated, and tests used to check for persistence. This creates a defensible record and prevents a cycle of unverified restores.
Frequently Asked Questions
Can I restore only the WordPress uploads folder and keep newer content?
Only if the host or a qualified specialist has established that every other executable location and the database are unaffected. Uploads can contain malicious files, and newer database records may include rogue users or injected settings, so a selective restore requires a documented scope review and a separate export of content you intend to keep.
How long should I keep backups after a WordPress compromise?
Keep several dated generations that span the period before the earliest plausible intrusion, rather than retaining only a rolling newest copy. Preserve at least one offline or separately controlled copy and record its time zone and contents so an attacker cannot silently replace your recovery history.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteShould I tell visitors or customers about a hacked WordPress site?
If personal, payment, health, or account data may have been accessed, involve your host, legal counsel, and applicable privacy or regulatory contacts before sending notices. The technical cleanup process does not determine notification duties; those depend on the data, jurisdiction, and evidence of access.
Can changing the WordPress admin password alone stop a backdoor?
No. A backdoor may use a modified plugin, theme, scheduled task, database user, hosting credential, SSH key, or stolen session. Rotate all relevant credentials, replace authentication keys, inspect account-level persistence, and repair the weakness that enabled entry.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
