iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Treat a hacked WordPress site or VPS as an active security incident, not just a bad plugin problem. First document what happened, then restrict access without destroying evidence, rotate every credential that could have been exposed, determine whether the compromise reaches the whole server, and recover only from verified-clean material. Reconnect the site only after every software layer is patched and stronger access controls are in place.
1. Document the compromise before changing anything
Write down the visible symptoms and the times you observed them before deleting files, reinstalling software, or restoring a backup. WordPress.org places documentation first because a simple timeline can reveal the entry point and helps a host or incident-response specialist work without guesswork.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Record the first time you noticed a defacement, redirect, spam page, unusual administrator, browser warning, antivirus alert, or provider notification.
- Save screenshots of altered pages, suspicious login notices, error messages, and search-engine warnings.
- List recent plugin, theme, WordPress core, operating-system, control-panel, DNS, firewall, and server-configuration changes.
- Note every unfamiliar user, scheduled task, process, domain, email, outbound connection, or new file you have already seen.
- Record the server timezone, your own timezone, and the clock source used by logs so investigators can align events.
Do not “clean up” while you are still trying to establish scope. Deleting a web shell or log entry may remove the only evidence of how the attacker entered or what data was accessed.
2. Decide whether to take the VPS or site offline
Containment limits additional damage, but an abrupt shutdown can destroy volatile evidence and interrupt legitimate business. If practical, restrict public traffic through the host, firewall, load balancer, or maintenance mode while you preserve a copy of the system. A VPS compromise must be treated as potentially broader than one WordPress directory: ask the hosting provider whether other sites, accounts, snapshots, API credentials, or services on the same VPS are affected.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use temporary isolation when
- Pages are actively redirecting visitors, serving malware, sending spam, or changing between requests.
- You see unknown administrative users, SSH keys, root-level processes, unfamiliar cron jobs, or outbound connections.
- The host warns of abuse, a search engine labels the domain dangerous, or customers report account takeover.
- You cannot confidently stop the attacker’s access while the service remains public.
Keep limited access only when
- You can place the application behind a restrictive firewall or allowlist and still preserve logs.
- Business continuity requires a short evidence-collection window and a qualified operator is watching the system.
- You have confirmed that the symptom is isolated and that no attacker-controlled process remains active.
Isolation can be as narrow as blocking web traffic or as broad as disconnecting the VPS from the network. CISA incident-response guidance recommends isolating affected systems; choose the least destructive control that stops ongoing access and document who applied it and when.
3. Preserve files, databases, and volatile evidence
Before cleanup, make read-only or otherwise protected copies of the affected files, database, web-server logs, authentication logs, firewall logs, control-panel records, suspicious binaries, and relevant timestamps. Keep the copies separate from the compromised machine and record hashes or another integrity check if you know how to do so.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteEvidence disappears quickly. CISA warns: “Preserve evidence that is highly volatile in nature—or limited in retention—to prevent loss or tampering,” including system memory, security logs, and data held in firewall log buffers. If you have the skills, capture running-process information, network connections, mounted volumes, active users, and memory before powering down. If you do not, ask the host or an incident-response professional to capture them rather than experimenting on a live system.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Minimum collection set
- A full database export, including user, order, form, and audit tables.
- The complete web root and server configuration, not only the files that look suspicious.
- HTTP access and error logs, SSH and SFTP/FTP logs, WordPress activity logs, and provider security alerts.
- Lists of WordPress users, administrator sessions, SSH authorized keys, cron entries, system services, and recently modified files.
- Copies of suspicious scripts or binaries in a quarantined location; do not execute them to “see what they do.”
4. Rotate every reachable credential from a clean device
Assume credentials exposed to the compromised environment may be stolen. Perform resets from a computer you have scanned and trust, using a separate network if the administrator’s usual device is suspect. Changing only the WordPress password is insufficient when an attacker may have obtained server, database, email, or DNS access.
| Credential or access path | Action |
|---|---|
| Hosting account and VPS control panel | Change the password, revoke active sessions and API tokens, review recovery email and phone details, and remove unknown users. |
| SSH | Replace keys, remove unfamiliar entries from authorized-key files, disable password login where feasible, and restrict allowed source addresses. |
| SFTP and FTP | Reset every account, remove unused accounts, and disable plain FTP in favor of encrypted access. |
| WordPress administrators | Reset passwords, invalidate sessions, remove unknown administrators, and review account email addresses and application passwords. |
| Database users | Rotate passwords, remove unused users, and limit each account to the database and permissions it actually needs. |
| Email, DNS, CDN, firewall, and registrar | Reset credentials, revoke tokens, inspect forwarding rules and DNS changes, and check for new delegated users. |
| Third-party integrations | Rotate payment, analytics, repository, backup, webhook, and deployment secrets; update them in every dependent system. |
| Reused passwords | Change the same password anywhere else it was used, including personal accounts connected to administration. |
WordPress.com specifically calls for account, WP Admin, and SFTP/SSH password resets. Treat that as the minimum, not the complete list for a VPS.
5. Add multifactor authentication before reopening administration
Enable two-step authentication on the hosting account, control panel, email, WordPress administration, domain registrar, source-control account, and other exposed services. WordPress.com describes a second step such as a phone code or a physical key. A USB security key can provide phishing-resistant authentication when the host, identity provider, SSH configuration, or control panel supports the required standard.
Recommended Free Tools
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
MFA rollout checklist
- Create at least two authentication methods, such as an authenticator app plus a hardware key, and store recovery codes offline.
- Enroll the owner and emergency administrator accounts, then remove shared logins.
- Test an actual sign-in and recovery flow in a private window before disabling the old method.
- Review remembered devices, active sessions, backup codes, and trusted applications; revoke anything unfamiliar.
MFA does not repair malware already on a server, but it reduces the chance that a stolen password alone restores access after recovery.
6. Investigate both WordPress and the VPS
Determine whether the intrusion is limited to one installation or reaches the operating system, other sites, control panel, and connected services. A clean-looking homepage does not prove the server is clean.
WordPress checks
- Compare core, plugin, and theme files with known-good versions and inspect unexpected changes to configuration files.
- Review administrator, editor, and application-password records for accounts you did not create.
- Inspect scheduled actions, database options, uploads, media metadata, and injected JavaScript or redirects.
- Review HTTP requests and activity logs for exploit paths, repeated login attempts, file uploads, and unusual user-agent or geographic patterns.
- Look for web shells hidden in uploads, cache directories, image files, temporary folders, or oddly named PHP files.
VPS and service checks
- List processes, listening ports, systemd services, cron and timer jobs, startup scripts, and recently modified system files.
- Inspect SSH login history, authorized keys, sudo configuration, control-panel users, and new accounts.
- Check outbound DNS, SMTP, HTTP, and cryptocurrency-mining traffic, along with unexpected bandwidth or CPU use.
- Review every virtual host, container, database, and application on the VPS; do not assume isolation between directories.
Run more than one appropriate server-side detection method when possible, but treat scanners as evidence-gathering aids rather than proof of cleanliness. WordPress.org warns that a local infection on an administrator’s computer can expose FTP and /wp-admin credentials. Run a full malware scan on every computer used to administer the site, including laptops, desktops, and build machines.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
7. Choose a recovery path based on confidence and scope
Recovery is safest when you remove the attacker’s persistence rather than deleting a few visible files. CISA recommends restoring from offline, encrypted backups, prioritizing critical services, and avoiding reinfection during recovery. A backup is useful only if it predates the compromise and has been checked for malicious changes.
| Recovery option | Best fit | Advantages | Risks and required checks |
|---|---|---|---|
| Fresh VPS rebuild | Root access, unknown persistence, multiple affected sites, or uncertain logs | Highest confidence that hidden accounts, shells, and altered system packages are removed | Requires documented configuration, clean deployment artifacts, patched software, and planned downtime |
| Known-clean backup restore | A verified backup made before the first suspicious event | Usually faster and preserves application data and configuration | Can reinfect the service if the backup contains a backdoor, vulnerable component, or stolen secret |
| Targeted file cleanup | Clearly limited incident with trustworthy forensic confirmation | Least disruption when scope is genuinely narrow | Hidden persistence is easy to miss; do not use this path when server or credential scope is unknown |
Safe rebuild or restore sequence
- Provision a fresh, supported operating system or clean hosting environment and restrict it with a firewall before attaching the domain.
- Patch the operating system, web server, runtime, database, WordPress core, plugins, and themes before importing data.
- Install only components from trusted, verifiable sources; do not copy unknown executable files or unverified plugins and themes from the compromised tree.
- Restore data after scanning it, review uploads and serialized settings, and recreate secrets rather than importing old credentials.
- Create new administrator, database, deployment, and SSH credentials, then enable MFA and least-privilege permissions.
- Test privately with a temporary hostname or allowlist, inspect logs, and confirm that redirects, spam, and unauthorized processes do not return.
- Change DNS or remove the isolation control only after monitoring is active and the host agrees that the environment is ready.
8. Patch and harden every layer
Outdated plugins and themes are common entry points identified by WordPress.com. Update WordPress core, every plugin and theme, the operating system, web server, runtime, database, control panel, containers, and exposed services. Remove abandoned, unused, or duplicate components rather than leaving them disabled but reachable.
- Use separate accounts for daily administration and emergency root access.
- Restrict SSH to trusted networks or a VPN, disable direct root login, and prefer key-based authentication.
- Apply least privilege to WordPress roles, database users, file permissions, service accounts, and deployment tokens.
- Place administrative interfaces behind an allowlist or additional access control where the application permits it.
- Keep backups offline or otherwise isolated, encrypt them, retain multiple restore points, and test restoration on a schedule.
- Enable file-integrity, login, web-application, and resource monitoring with alerts sent outside the VPS.
9. Monitor for reinfection and handle notification duties
For at least the next several weeks, watch authentication and web logs, file-integrity alerts, scheduled tasks, outbound email, CPU and bandwidth, search-engine warnings, antivirus detections, and customer reports. A returning redirect, new administrator, unexplained cron job, or sudden outbound traffic is a reason to isolate the service again rather than repeatedly deleting symptoms.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
If personal data, payment information, credentials, health information, or other regulated data may have been accessed, activate the applicable incident-notification plan. CISA directs organizations to follow notification requirements when a breach occurs. The deadlines and recipients depend on your jurisdiction, contracts, industry, and the type of data, so obtain legal advice and qualified security help promptly.
When to bring in a specialist or your hosting provider
Contact the host immediately when you see root-level activity, multiple affected accounts, provider abuse notices, suspicious outbound traffic, or uncertainty about snapshots and logs. Engage a qualified incident-response or WordPress malware-removal professional when persistence is suspected, evidence may matter legally, payment systems are involved, or you cannot verify the backup and rebuild process. Ask for a written scope, evidence-preservation plan, recovery point, and hardening recommendations rather than a promise to “clean” the visible page.
This guidance cannot determine the facts of a particular compromise. Preserve evidence and obtain professional advice whenever legal, regulatory, payment-card, or data-breach obligations may apply.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
