Over the years, I have developed a process/procedure to recover a hacked site. While backups are good, it’s not always clear that a backup is ‘clean’ and not hacked.
My process includes reinstalling all code (WP, plugins, themes) manually (themes/plugins via FTP from known good source, WP via the ‘update again’ on the Update page), changing all credentials (hosting, email, users, database), and more; and manual inspection of files.
It can be time consuming, and I believe is much more thorough than automated scanning tools or services.
My process is here: http://securitydawg.com/recovering-from-a-hacked-wordpress-site/ .
Good luck.
Related Posts:
- Can a WordPress plugin or theme contain a virus?
- Suspicious google tag manager
- Advice and plugins against Malware [closed]
- WordPress filter that hook after each action/filter hook
- My WordPress website was hacked [closed]
- UpdraftPlus installed malware – scared to download or update plugins now! [closed]
- How to create a plugin with automatic update?
- Bing/msn bots is heavily requesting random of my website
- Is a Virus detection plugin necessary?
- src=”https://dns.firstblackphase.com/scripts/start.js” [closed]
- whole website redirected to another page
- Create tabs inside Plugins Admin Page [closed]
- Remove action from plugin on other plugin
- WordPress Plugin Development In MVC Architecture, How?
- Changing title of a page dynamically from within a plugin
- Allowing Two Developers Access to a Plugin on the WordPress.org Plugin Repository?
- How to build an API as a plugin
- category_name not working (not showing up in sql query debug)
- What happens when two plugins have the same 3rd party class included into them?
- add_rewrite_rule, plugin activation and plugin deactivation
- Update Multiple Post Meta for the Same Post In One call?
- Allowing Custom Capability to Manage Plugin Options
- wp_insert_user – how to send verification email before logging in
- Custom plugin settings: clicking “save changes” does not display success message
- WordPress Hook that will run when media file deleted
- Prevent multisite sites from using a plugin
- WordPress wp-json API – Custom Post Type returns 403
- Create custom column in post table in wordpress
- Plugins won’t auto-update on IIS
- Make plugin uninstalable on older versions of WordPress
- Add .html extension to custom post type taxonomies
- How to load a new template page according to a particular URL?
- Translate wordpress plugin [closed]
- Styles and Scripts, Selectively enqueue across entire site
- Get the current taxonomy product category title in woocommerce
- Exclude custom post_type in sitemap generation?
- Custom Post Type causes Page Not Found
- How can I filter blog name?
- Removing WordPress Plugin Menu Item for a specific user
- The plugin generated x characters of unexpected output, $wpdb not defined
- Detect if a plugin was included in a certain page
- How can I make the “Preview Post” button save and preview in the same window?
- How to add an attribute to the body tag with a plugin?
- Override the core function locate_template
- Admin page: form with enctype=”multipart/form-data” does not transfer its data
- how to load tinymce external plugin
- Organising the plugins folder in wordpress
- Cannot run the code after I activate the plugin
- Plugin could not be activated because it triggered a fatal error. (No Error??)
- Use oEmbed in List Items
- Trigger renewal order emails for WooCommerce subscriptions for testing
- How Can I Pass the Shortcode’s $atts Variable to the Plugin’s Javascript Function
- Weird problems after recovery from security breach
- How to retrieve custom meta term of category taxonomy from WP Rest API?
- Set user ID at time of wp_create_user
- Reset WordPress website
- Problem with wp_enqueue_scripts in plugin
- Best Practice: Remove data on deactivation or uninstall?
- WooCommerce & Caching [closed]
- WordPress Ajax Callback
- Regex to Remove File Extension
- Portfolio + Blog: multisite or plugin?
- Building a store locator with google maps
- Runng Cron Job for Plugin With No CronTab Access
- Creating a social media score plugin
- google conversion code
- Collapse content [closed]
- myCRED custom hook preferences doesn’t update creds and log
- Can’t add custom Taxonomy to Custom Post Type
- add_menu_page does not seem to work in a class
- Form isn’t inserting data into database with ajax plugin
- How to create custom tables in WordPress using my own plugin?
- How can I create a custom shortcode that will return a custom post type by ID?
- importing plugin w/ settings from one WP installation to another
- After plugin options changed hook
- How to make a slideshow shortcode based on the WordPress gallery shortcode? [closed]
- How to enable qTranslate languages tabs in custom plugin page
- WordPress CodeHighlighter
- How would I go about creating a user ranked post popularity page?
- All of my custom posttypes are 404’ing
- WordPress: PHP code rendering in the wrong place
- New to wordpress, Question about editing PHP
- Plugin: Google Analytics for Dashboard error – Timestamp is too far from current time
- Linking an image to open a youtube video in lightbox/fancybox in wordpress
- ‘No Results Found’ on single post for custom post type
- Exporting post content from wordpress using WP All Export and wpautop() php function to include paragraph tags
- How to modify WCMP Rest API response?
- Making a Template for a CPT created by a plugin
- How to remove the inline styles from the content of a WYSIWYG editor field at the time of saving the post?
- How can I change the plugin update server for specific plugins?
- How to create an input field, and base the output on spreadsheet data? [closed]
- Blacklist IP After Using WordPress Plugin Detector?
- posts comments goes to trash
- User registration
- WordPress plugin subscribe2 not looking the same as before migration
- Admin style for just one plugin in dashboard
- Multiple instance of data in plugin custom database table on plugin activation
- Trouble adding tiny mce to textarea in custom plugin
- Js file is not adding using this code in functions.php
- Show meta box only when post is being published first time