A compromised site is urgent but not a reason to panic. What matters most is doing things in the right order. The most common mistake is to start cleaning immediately. The malicious code disappears from view, but the way in stays open, and the site is broken into again a couple of weeks later.
The typical signs are unfamiliar pages appearing on the site, a redirect to an unknown address that only fires when arriving from a search engine, unknown administrator accounts, a Google warning in the search results and a browser notice about a dangerous site. Sometimes the only sign is that the site is suddenly slow, because the server is busy sending spam.
| Step | Why |
|---|---|
| 1. Back up while infected | It is needed to work out what happened and when. Without it the way in stays a guess. |
| 2. Change the passwords | WordPress, hosting, FTP, the database and email. One forgotten account is enough to let the attacker back. |
| 3. Check the admin accounts | Remove unknown users. An attacker often leaves an account behind as a spare. |
| 4. Only then clean up | Remove the malicious code, restore files from clean sources and check the database. |
A deleted file takes the record of what happened with it. If you do not know which file is malicious and which is part of the site, do not delete it. Take a backup and ask for help. The same applies to restoring the whole site from an old backup. If you do not know when the break-in happened, you can restore an already infected version and believe the problem is solved.
Most break-ins are not targeted but automated. A bot looks for known vulnerabilities and works through thousands of sites. The usual routes are an unpatched plugin or theme, a weak or leaked administrator password, an old PHP version and another site on the same server that has not been updated. That last one is why an old forgotten test site is worth deleting rather than leaving asleep.
If a warning shows in the search results or in the browser, the site is on Google Safe Browsing. The warning does not clear by itself after the clean-up. You have to request a review in Google Search Console. Make the request only once the site is genuinely clean, because a rejected request slows down the next one.
A clean-up is typically 5 to 10 hours of work. Keeping updates current costs a fraction of that. Automatic backups, a current PHP version and updated plugins cover the bulk of the risk. See also backing up and restoring a site.
We clean the site, close the route that was used and ask the search engine to remove the warning. The amount of work depends on how far the break-in got, and you get an estimate before we start. A compromised site goes into work within twenty four hours.
