Respond to a suspected compromised website

Unexpected redirects, unfamiliar administrator accounts, altered files, or unauthorized mail can indicate a compromise. Treat an unexplained change as an incident to investigate. Simply removing the visible symptom may leave the access method in place.

1. Record what you observed, affected URLs, the approximate start time, and recent changes. Preserve screenshots, relevant logs, and a separate copy of the current files and database where possible. Keep this evidence private and label it as potentially compromised.
2. Contact hosting support through a known account channel. Provide the domain and observations, and ask for help containing affected services if you cannot do so with your account permissions. Avoid sending passwords, private keys, or a public link to a sensitive backup.
3. Use a trusted device to secure access. Change affected customer-account, control-panel, application-administrator, mailbox, and file-transfer credentials as appropriate. Review recovery email addresses and enable multi-factor authentication where supported. Revoke unfamiliar accounts, sessions, keys, and integrations. Coordinate database-password changes with application configuration.
4. Inspect the application and its extensions. Replace modified program files from trusted original packages, remove unused components, and install supported security updates. A scan can assist investigation but does not prove every malicious change has been removed. WordPress provides an incident recovery guide for WordPress sites.
5. If restoring a known-good backup, choose one from before the compromise and fix the original vulnerability before returning the site to service. Examine database content, scheduled jobs, administrator users, forwarding rules, and stored configuration as relevant to the incident.
6. Rotate secrets again if they were exposed during cleanup. If a TLS private key was accessed, ask support about replacement and revocation. Review application permissions and ongoing update practices. WordPress hardening guidance

Check the result: Test normal functionality, review outbound mail and recent changes, and monitor for recurrence. Confirm unfamiliar access has been removed and a clean backup has been created. If customer information may have been exposed, escalate to the person responsible for your organization's incident response and communications.

Common problems: Restoring only the homepage, changing one password, or reinstalling without addressing the vulnerable component can allow reinfection. Do not run unfamiliar cleanup commands from an unsolicited message. Request specialist investigation when the extent of the incident remains uncertain.

Related: Backups, Restoration, Pause mailbox sign-in, Certificate reissue.