iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Restoring a WordPress backup can bring a damaged site back online, but it does not by itself prove that the vulnerable plugin, an attacker-created file, a changed database record, or a stolen login session is gone. Treat recovery as an incident-response process: document what happened, preserve the affected site, choose a trustworthy restore point or clean the existing installation, patch the entry point, rotate credentials, and investigate how access occurred.
The safest sequence is to preserve evidence first, then make a deliberate restore-or-clean decision. A site should be considered recovered only after the software and data have been checked, sessions and credentials have been invalidated, the original weakness has been closed, and monitoring shows no continuing compromise.
What “restore” needs to accomplish
A plugin exploit can affect more than the plugin’s directory. An attacker may add a new PHP file, alter a theme or core file, create an administrator account, insert code into the database, change scheduled tasks, or steal credentials and browser sessions. Replacing visible files may leave one of those footholds intact.
Recovery therefore has five separate goals:
- Preserve a usable record of the incident before cleanup changes the evidence.
- Return the site files and database to a state you can defend as appropriate for the incident date.
- Remove malicious additions and repair or replace compromised software.
- Close the exploited vulnerability and invalidate credentials or sessions that may have been exposed.
- Determine how the attacker entered so the same path is not left open.
WordPress.org describes backups as “a critical piece of your continuation of operations” and recommends actively planning for them. A backup is a recovery resource, not a certificate that a site is clean.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Before changing anything: contain, record and preserve
Limit further damage
If the site is actively redirecting visitors, sending spam, creating unknown users, or exposing private information, put it into the least harmful state your host supports. A maintenance page, temporary access restriction, or host-level suspension can reduce further changes while you collect evidence. Do not delete the plugin or wipe the server before making a copy; that can destroy the information needed to understand the attack.
Write an incident record
Record facts while they are still available. Include:
- Exactly what you see: defacement, redirects, login failures, new users, suspicious emails, warnings from a host, or an unfamiliar file.
- When each symptom was first noticed, including the timezone, and whether it is still occurring.
- Recent plugin, theme, WordPress, hosting, DNS, or configuration changes.
- The site address, hosting company, server type, PHP version if known, and whether a content-delivery or web-application firewall sits in front of it.
- Who has administrator, hosting, database, SFTP, SSH, DNS, and email access.
The WordPress.org hacked-site FAQ frames the first diagnostic question as: “What are you seeing that leads you to believe you are hacked?” Answering that question precisely prevents a vague cleanup from missing the affected component.
Preserve a snapshot
Make a separate copy of the affected files and database before restoration or deletion. Keep it read-only if possible, label it with the date and timezone, and restrict access because it may contain passwords, personal data, or malicious code. WordPress.org recommends preserving a snapshot even when it is infected: it may be needed for forensic work or to recover if a cleanup fails.
Choose the recovery path
There is no universal rule that a backup restore is safer than cleaning the current installation. Decide using the evidence you have and the data that must be retained.
| Decision factor | Restore a pre-incident backup | Clean the existing installation |
|---|---|---|
| Backup confidence | Useful when the date is clearly before compromise and the files and database can be validated. | Necessary when no trustworthy pre-incident copy exists. |
| New content | Posts, orders, comments, uploads, and user changes after the backup must be preserved separately or replayed. | Recent data remains in place, but compromised records must be identified and corrected. |
| Vulnerable plugin | The plugin still needs to be removed or upgraded after the restore; restoring an old copy does not fix its flaw. | Replace it with a vendor-fixed version or remove it before reopening the site. |
| Persistence outside ordinary files | A file restore may not remove malicious database records, hosting accounts, scheduled jobs, or stolen credentials. | These areas can be examined directly, but the work is more technical and easier to get wrong. |
| Verification ability | Best when you can test the backup in isolation and compare it with the incident timeline. | Best when you have logs, a known-good package, and the expertise to inspect the whole environment. |
If you cannot establish when compromise began, treat every backup created after that point as potentially contaminated. If important data was created since the last reliable backup, export or preserve it before replacing the live database.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Assess a backup before restoring it
Confirm what the backup contains
Identify the backup’s creation time, timezone, retention policy, and scope. A complete WordPress recovery normally requires both the site files and the database. Also check whether the copy includes uploads, server configuration, cron definitions, email settings, and other hosting-level items that your site depends on.
Compare the date with the incident timeline
Use your incident record to set a latest-safe date: a backup must predate the earliest credible compromise, not merely the day the problem became visible. Attackers can remain dormant, so “the site looked normal” is not proof that a later backup is safe.
Verify integrity and test privately
Check that the archive can be read and that the database dump imports without errors. When your host allows it, restore the copy to a temporary, non-public environment. Test the homepage, login, media, forms, scheduled tasks, payment or membership functions, and administrator accounts there before replacing production. Do not expose a test copy with live credentials or private customer data.
Remember that restore tools have their own risks
Restore software must be kept secure and configured correctly. A National Vulnerability Database example describes a backup/restore-plugin artifact that could expose a backup archive after an interrupted restore on certain server configurations. That example is not evidence that your site or plugin is affected; it is a reason to protect backup archives, remove temporary files, and verify the current advisory for any tool you use.
Path A: restore a trustworthy pre-incident copy
- Preserve the live snapshot and recent data. Export or copy content created after the selected restore point, including uploads, orders, comments, and user records that must not be lost.
- Put the site in maintenance or restricted mode. Prevent visitors and editors from changing data while the replacement is performed.
- Restore both files and database. Use your host’s documented process, and confirm that the database belongs to the same site files and WordPress configuration. A files-only restore can leave malicious database content behind; a database-only restore can leave infected files in place.
- Inspect the restored copy before making it public. Check administrator accounts, plugins, themes, uploads, scheduled tasks, redirects, and configuration values. Remove anything that was not present at the selected date or cannot be explained.
- Remove or replace the exploited plugin. Do not reactivate the vulnerable release merely because it was present in the backup. Install a supported fixed release only after verifying the current vendor advisory, or remove the feature if no safe version exists.
- Reconcile legitimate post-backup data. Bring back clean content through controlled exports or manual review rather than importing an entire newer database that may contain persistence.
- Continue with credential rotation, patching, and investigation. A successful restore is the midpoint of recovery, not the final check.
Path B: clean the existing installation
Cleaning in place is appropriate when no reliable backup exists, when recent transactions cannot be discarded, or when an experienced administrator can inspect the entire environment. WordPress.org notes that the exact procedure depends on the symptoms and the owner’s technical ability.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallReplace software with known-good copies
Use official, supported packages for WordPress core, the affected plugin, and themes. Match the version required by the incident or vendor guidance while you are identifying the problem; then move to the supported fixed release. Do not assume that uploading files over the top removes an attacker’s additions. Common reinstall mechanisms overwrite existing files but may leave newly introduced files that are not part of the package.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Remove suspicious additions
Compare core, plugin, and theme directories with a known-good distribution. Look for unexpected PHP files, altered file timestamps, executable files in upload directories, unfamiliar administrator tools, and configuration changes. Preserve a copy of anything suspicious before deletion so it can be examined. Avoid deleting legitimate custom code without checking how the site uses it.
Inspect the database
Review administrator and editor accounts, options that load code or redirects, scheduled actions, widgets, menus, posts, and comments for unexpected entries. Search for injected scripts or links in places where your site normally stores content. Database cleanup can damage the site if performed with broad replacements, so take a fresh database backup before editing and record each change.
Check hosting-level persistence
Inspect SFTP or SSH users, hosting control-panel accounts, cron jobs, DNS changes, deployment keys, and email-forwarding rules. A WordPress file cleanup cannot remove an attacker who still controls the hosting account or a separate service.
Patch the weakness and invalidate access
Do these actions after the site has been cleaned or restored, because changing credentials before removing malware can simply give the attacker new credentials to steal.
- Update WordPress core. Install a supported release appropriate to your site and verify that the update completed without errors.
- Update or remove the affected plugin. Confirm the vendor’s fixed release or security guidance. If no supported fix exists, disable and remove the plugin and replace the functionality with a maintained alternative only after evaluating compatibility.
- Update themes and other plugins. An exploited plugin may not be the only outdated component. Remove software that is unused rather than leaving it installed and inactive.
- Change WordPress passwords. Reset every administrator and any account that could publish, install plugins, or edit files. Use unique passwords that are not reused on hosting, email, or other sites.
- Change database credentials when exposure is possible. Update the database user password and the matching value in
wp-config.php, then test the site. - Replace WordPress secret keys and salts. Regenerate the authentication keys in
wp-config.php. WordPress.org says this logs out existing sessions, including sessions that an attacker may have stolen. - Rotate hosting, SFTP, SSH, control-panel, DNS, deployment, and email credentials. Include API keys and application passwords if they could have been visible to the compromised site.
Find how the attacker got in
Root-cause analysis determines whether the fix will last. Build a timeline from web-server access logs, WordPress activity logs, hosting events, firewall alerts, plugin update history, database changes, and user-account records. Look for requests to the vulnerable plugin, unexpected administrator creation, file-upload events, password resets, and activity from unfamiliar addresses or user agents.
Separate facts from assumptions. A suspicious file proves that a file was changed; it does not, by itself, prove which request created it. Correlate timestamps across the web server, database, hosting panel, and any firewall. Preserve original logs because rotating or editing them can destroy the timeline.
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Forensics may be impossible when logs were not retained, the attacker altered them, or the owner lacks server access. In that case, document the uncertainty rather than claiming a definitive root cause. WordPress.org points owners who cannot confidently clean and validate a hacked site toward the WordPress.org Hacked or Malware forum for help. A qualified incident-response professional may be appropriate when personal data, payments, or a business-critical site is involved.
Free tools Windows power users keep installed
One-click scans. No signup required.
Verify the site before reopening it
Use a separate administrator account or controlled test session for validation. Check each item once:
- The vulnerable plugin is removed or running a supported fixed release.
- Core, themes, and remaining plugins match known-good packages.
- No unexplained administrator, hosting, database, SFTP, SSH, DNS, or email accounts remain.
- Uploads and other writable directories contain only expected content.
- The database has no unexplained options, redirects, users, posts, or scheduled actions.
- Secret keys and passwords were changed after cleanup.
- Front-end pages, forms, media, redirects, logins, and administrative functions work normally.
- Logs show no continuing exploit requests or unexpected outbound activity.
- The backup used for recovery and the preserved incident snapshot are stored separately from the live server.
A scanner can help identify indicators, but a clean scan is not proof that every persistence method or stolen credential has been eliminated. Keep monitoring after the site returns to normal.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Strengthen the backup and recovery plan
Keep files and database copies
Schedule backups for both WordPress files and the database. Store at least one copy separately from the hosting account so an attacker who controls the server cannot silently delete every recovery point. An external hard drive can serve as one additional copy, but the device, archive, and access credentials still need protection.
Test restoration, not just backup creation
Periodically open an archive and perform a test restore in a private environment. Record how long the process takes, which settings must be recreated, and which data is not included. A backup that has never been restored is an unverified assumption during an outage.
Recommended Free Tools
Reduce the blast radius
Remove unused plugins and themes, limit administrator access, keep hosting and WordPress software supported, and protect the control-panel and email accounts that can reset the site. Consider a managed web-application firewall where it fits your hosting model, but treat it as an additional control rather than a substitute for patching, backups, and credential rotation.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Example: what a managed platform response does—and does not—show
In an account published May 21, 2026, WordPress.com described responding to the Essential Plugin attack with a managed web-application firewall and off-site Jetpack VaultPress Backup restores for affected sites. This demonstrates the value of filtering and an independently stored restore point in that platform’s environment. It is not a universal WordPress requirement, a guarantee that every installation can use the same process, or independent evidence that a particular backup service is suitable for your site.
If you discovered a vulnerability instead of merely being exploited
Keep an undisclosed security flaw confidential while it is being assessed. WordPress.org’s plugin-security guidance asks for a concise description, a link to the specific directory plugin, and whether the reporter validated the issue. Plugin issues should be reported to the developer and the WordPress.org plugins team through the security reporting route. The relevant handbook page was last updated January 2, 2026.
Do not publish exploit details, proof-of-concept code, or a vulnerable version publicly while users remain exposed. If your site was attacked, preserve the evidence and disclose the incident to affected parties according to your legal and contractual obligations.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →When professional help is the safer choice
Stop and obtain qualified help when you cannot identify a trustworthy restore point, the attacker may have reached the hosting account, customer or payment data may be involved, logs are missing, or you cannot verify that the entry point is closed. Community support can help with general WordPress recovery, while a specialist with server-level access may be needed for malware analysis and evidence preservation.
Provide the helper with your timeline, preserved snapshot, backup inventory, hosting details, observed symptoms, and actions already taken. Do not send passwords or an unredacted database through an insecure channel.
Quick Recap
Recovery checklist
- Record symptoms, times, recent changes, and the hosting environment.
- Preserve a copy of the affected files and database.
- Identify backups containing both files and database, and compare their dates with the incident timeline.
- Test the chosen restore point privately when possible.
- Restore both components or clean the existing installation using known-good packages.
- Remove the vulnerable plugin or install its supported fixed release.
- Inspect files, database records, users, scheduled tasks, and hosting access for persistence.
- Update core, themes, and remaining plugins.
- Change WordPress, database, hosting, SFTP, SSH, DNS, email, and API credentials as applicable.
- Regenerate the secret keys in
wp-config.php. - Investigate logs and document what remains uncertain.
- Test the site, monitor it, and keep a separate verified backup.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
