WordPress Site Hacked? What to Do in the First 24 Hours

Step-by-step actions to contain a WordPress hack, restore service, and prevent reinfection — for site owners and agencies.

If you suspect your WordPress site has been hacked, act quickly but methodically. The first goal is to stop further damage and protect visitor data.

Take the site offline or put it in maintenance mode if possible. Change all passwords: WordPress admins, hosting panel, FTP/SFTP, database, and email accounts linked to the site.

Scan files and the database for malware, suspicious admin users, unknown plugins, and recently modified core files. Compare checksums with a clean WordPress release when you can.

Restore from a clean backup only if you are certain the backup predates the compromise. Otherwise, manual cleanup or professional incident response is safer.

After cleanup, update WordPress core, themes, and plugins; remove unused extensions; enforce strong passwords and two-factor authentication; and review file permissions.

Ongoing maintenance — security patches, monitoring, and tested backups — reduces the chance of reinfection. SupportWP support plans include incident response for eligible clients.