Announcing Duplicator WP-CLI Commands (And How They Speed Up Backups)
Looking for a smarter way to manage site backups? Explore Duplicator's new features, including customizable WP-CLI commands and permission settings!
Announcing Duplicator WP-CLI Commands (And How They Speed Up Backups)
Joella Dunn
Joella Dunn
John Turner
John Turner
Millions of websites are built with WordPress, making it a prime target for hackers.
If you suspect your website might be compromised, take a deep breath. Recovering a hacked WordPress site is absolutely possible, and we’ll walk you through the steps to get your site back online safely and securely.
In this guide, we’ll show you everything you need to know about recovering your WordPress site from a hack. Let’s get started!
Yes, in most cases, you can recover a hacked WordPress website! The difficulty of the recovery process depends on the severity of the hack. The good news is, with a recent backup, you can restore your site to a clean state relatively quickly.
Your hosting provider, a professional developer, or security agencies can also help you get your site back online. If you have experience with WordPress, you’re free to clean your own database, change your passwords, and remove malware.
While hackers can get pretty creative, there are some common culprits behind most WordPress hacks.
Let’s take a look at the usual suspects!
Weak Passwords
Think of your password like your front door lock. A weak password is easy to crack and break through.
Your passwords could get stolen by hackers. They could also use bots to randomly guess your password until they access your site. This is called a brute force attack.
Out of Date Software
Just like your car needs oil changes, your WordPress core, themes, and plugins need regular updates to fix security vulnerabilities. Hackers love to exploit these outdated systems.
Vulnerable Themes and Plugins
Not all themes and plugins are created equal. Some might have built-in vulnerabilities that hackers can take advantage of. It’s important to choose themes and plugins from reputable developers who prioritize security.
Insecure Web Hosting
A reliable web host should have security measures like firewalls and malware scanners that protect your website from external threats. If your hosting provider skimps on security, your site becomes more susceptible to attacks.
Imagine walking into your house and finding things out of place. A hacked website can give off similar warning signs. Here are some red flags to watch out for.
Injected Spam Content
Is your website suddenly displaying irrelevant ads or links you didn’t put there? Hackers might be injecting spammy content into your site’s code.
Broken Layouts and Design Issues
Does your website look distorted or jumbled? Hackers can tamper with your site’s files, causing layout issues and design problems.
Login Issues
Are you having trouble logging into your WordPress admin dashboard? Hackers might have changed your login credentials or blocked your access altogether.
These are just a few indicators of a potential hack. You could notice other suspicious signs like:
Using website monitoring tools can help you stay alert to any suspicious activity on your site. Your web host or security plugin may send you notifications after your site has been hacked.
If you notice some of the warning signs of hacking, you might panic. However, you can easily recover hacked WordPress sites!
A hacked website can be embarrassing and even harmful to your visitors. By putting your site in maintenance mode, you prevent them from seeing the compromised version.
It gives you breathing room to diagnose the hack, clean up your site, and implement security measures without the pressure of live visitors.
I’d recommend using SeedProd to put your WordPress site in maintenance mode. It’s a user-friendly plugin that lets you activate a customizable coming soon page while your site is under repair.
This maintenance page informs visitors that you’re working on your site and it’ll be back online soon. For more details, here’s how to put your WordPress site in maintenance mode.
If your WordPress site gets hacked, all you’ll need is a backup. A backup is a complete copy of your website, including all files, databases, and settings. Restoring a backup essentially rewinds your website to a clean state before the hack occurred.
Using a backup plugin like Duplicator, restoring your site is a breeze. Duplicator allows you to schedule backups so you never have to worry about them. Once something goes wrong, find a backup on the Packages page and hit Restore.
Sometimes, a hacker will lock you out of your WordPress dashboard. Don’t worry, you haven’t lost your site forever!
With Duplicator, you can set a backup as the disaster recovery point. It’ll give you a disaster recovery link. Keep this in a safe place just in case of cyber attacks.
After a hack, simply paste this link into a new browser window. Use the Duplicator recovery wizard to get your site back online (without your dashboard).
Many web hosting providers offer automatic backup services. If yours does, you’ll likely be able to restore your site from your hosting control panel. However, this might not always be an option, especially if the backup isn’t recent enough.
Worst case scenario, you can still restore your site without a backup. But, it’ll be difficult to regenerate the files and database exactly as they were before.
After a cyber attack, there’s a chance some malicious code is lurking on your site. Think of malware as a digital virus that can infect your website and cause damage.
Inactive themes and plugins are often used as backdoors, so I’d recommend deleting them.
To scan for malware, consider installing a WordPress security plugin. Here, Sucuri comes to the rescue.
Sucuri is a popular website security service that offers comprehensive website scanning and malware removal. Their tools can help you identify and eliminate any malicious code that might be hiding on your site.
Once you install Sucuri, it’ll run a full scan for malware. You’ll see if you have any hacked files.
If you’re using the premium version of Sucuri, you’ll get expert WordPress malware removal. Otherwise, you can download fresh copies of corrupted WordPress files and overwrite the ones with malware.
To do this yourself, read this guide on how to find hacked WordPress files.
Regaining control of your website after a hack means taking back ownership of all your login credentials. Be sure to reset all of your WordPress passwords.
Create complex passwords with a mix of uppercase and lowercase letters, numbers, and symbols. Avoid using the same password for multiple accounts.
And don’t just stop at your WordPress admin password! Reset any password associated with your website, including your hosting account, FTP credentials, MySQL, and email address.
By following these steps, you make it significantly harder for hackers to gain access to your website again.
Hackers love to exploit known vulnerabilities in outdated software. Updates often include security patches that fix these vulnerabilities and make your website less susceptible to attacks.
Once you recover your site and reset your passwords, go to the Updates page. Start any updates available for your core WordPress software.
Make sure to update all your themes and plugins to their latest versions as well. Theme and plugin developers frequently release updates that address security issues and improve overall functionality.
By keeping your WordPress core, themes, and plugins updated, you significantly reduce the risk of your website being hacked again through these vulnerabilities.
Hackers might create new user accounts on your site to maintain access even after you regain control. Reviewing user permissions allows you to identify any suspicious accounts that shouldn’t be there.
Once you identify suspicious users, remove them from your website immediately. This eliminates any backdoors the hacker might have created for future access.
Grant users only the minimum level of permissions they need to perform their tasks. For example, a content writer doesn’t need administrator privileges.
Keep in mind that some plugins have advanced user permissions to tighten security even more. You wouldn’t want a hacker to use Duplicator to make a copy of your website or overwrite its current data. So, you can go into the settings and adjust who can use the plugin.
Repeat this process with any plugin that has this feature.
Your WordPress site has security keys that make it easier for you to stay logged into your dashboard. Your login credentials are encrypted and saved as cookies. They are translated using security keys, which are stored in the wp-config.php file.
A hacker could’ve accessed your site by stealing your password. Once they log in, WordPress will generate secret keys for them. They’ll stay logged in as long as their cookies are valid.
To log out unauthorized users, you’ll need to change your security keys. Sucuri can help with this.
In the Settings, go to Post-Hack. Click on the Generate New Security Keys button.
Sucuri can also automatically update your security keys. You can generate new ones every day, week, month, or quarter.
Databases store a lot of information behind the scenes, including website content and user data. Hackers might exploit this by injecting malware directly into your database.
To regain your customer and order data, you’ll need to clean up your database.
If you suspect your database might be infected after a hack, consider seeking help from a qualified WordPress developer to ensure a thorough cleanup.
You can also use a plugin like WP-Optimize. It will clean up the information that isn’t important in your database.
However, cleaning a database, especially if it involves complex queries or code manipulation, is best left to a WordPress developer. They have the expertise to identify and remove malicious code without damaging your website’s functionality.
After a hack, there’s a chance search engines might have flagged your website as suspicious. Recreating a sitemap can help restore your SEO health.
A sitemap tells search engines where to find all the important pages on your website. After a hack, your sitemap might be outdated or contain links to compromised content. Creating a new sitemap ensures search engines have the latest information about your website.
By informing search engines about your clean website, you can help them re-crawl and re-index your site. This can improve your website’s search ranking.
There are several ways to create a new sitemap for your WordPress site. All in One SEO is a popular SEO plugin that can help you easily regenerate your sitemap with just a few clicks.
With AIOSEO, go to the Sitemaps page. Then, enable your sitemap.
Check your new sitemap for any errors.
If all the links look correct, find AIOSEO » General Settings » Webmaster Tools. Click on Google Search Console and then connect your site to this tool.
Once AIOSEO is linked with Google Search Console, your sitemap will automatically be submitted. Google will re-crawl this new healthy sitemap.
If your website has been severely compromised or the hack seems beyond your technical expertise, consider seeking professional help. WPBeginner provides expert assistance with restoring and cleaning hacked sites.
With this WPBeginner pro service, WordPress experts will remove any malicious code on your site. Their team has been securing sites for over a decade, so you know you’ll get your original website back.
Many web hosting companies offer security features and support. They might be able to help you scan your site for malware or restore backups if you’re unable to do it yourself.
For technically savvy users, there’s also the option of manual recovery. This involves deactivating all plugins and themes, reinstalling WordPress core, and manually cleaning files for malware.
However, this approach is recommended for experienced users only. Any mistakes can cause further damage to your website.
Recovering from a hack can be stressful, but there’s a lot you can do to secure your WordPress site and avoid being hacked in the first place.
We’d recommend using strong, unique passwords for all your website-related accounts, including WordPress admin, hosting login, FTP, and email. Consider using a password manager to generate and store complex passwords securely.
Always keep your WordPress core, themes, and plugins updated to the latest versions. Updates often include security patches that fix vulnerabilities. Enable automatic updates whenever possible to streamline this process.
Consider installing a reputable security plugin like Sucuri or Wordfence to add an extra layer of protection to your website. These plugins can scan your site for malware, block suspicious traffic, and alert you to potential security threats.
Regular backups are your safety net. Having a recent, clean backup allows you to quickly restore your website in case of a hack. Use a reliable backup plugin like Duplicator Pro to automate your backups so you always have one when you need it.
As we mentioned before, Duplicator can set recovery points, allowing you to restore backups without your dashboard. To get started, find a recent full-site backup. Click on the blue house icon next to it.
In the pop-up, continue setting disaster recovery.
Finally, copy your recovery link or download the launcher file. Store either of these options away from your WordPress site. If your website ever goes down, paste the link into a web browser or open the recovery file.
By following these security best practices, you’ll ensure your website remains safe for your visitors.
If your hack seems complex or you’re not comfortable with technical troubleshooting, consider seeking professional help. WPBeginner offers expert assistance with cleaning hacked sites. However, you can restore a backup to immediately roll your site back to a clean, functional state.
Hacked websites can contain malware that infects your device when you visit. This malware can steal your information or damage your device. If you suspect a website is hacked, avoid visiting it.
To fix hacked WordPress sites, start by putting your site in maintenance mode to prevent visitors from seeing the compromised version. Then focus on restoring a backup, scanning for malware, and updating your website.
Even if you can’t log into your WordPress site, you can still recover it. With Duplicator Pro, you’ll set a backup as the disaster recovery point. After a cyber attack, paste the recovery link into a browser window to jumpstart the recovery wizard.
Watch for warning signs like injected spam content, broken layouts, or login issues. These could indicate a successful cyber attack. You can also use website monitoring tools to detect suspicious activity.
We hope you now know how to recover your hacked WordPress site!
While you’re here, I think you’ll like these extra WordPress guides:
Did your website just get hacked? Immediately recover a backup (in one click) with Duplicator Pro!
Disclosure: Our content is reader-supported. This means if you click on some of our links, then we may earn a commission. We only recommend products that we believe will add value to our readers.
