Has your WordPress site been hacked?
I can save your website!
According to borncity.com, approximately 90 million websites were targeted using the “WP2Shell” attack chain following the latest WordPress core security update. The affected WordPress versions are 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. If you haven’t installed this update yet, I strongly urge you to do so as soon as possible!
Here, I’ll explain
- how to recognize an attack on your WordPress site,
- how I can restore your system without data loss (immediate actions, malware removal, and recovery), and
- how you or I can prevent another attack (security check).
If you discover that your WordPress website has been hacked, the first thing you should do is stay calm. Panicking can quickly lead to the complete loss of your website’s data. Then all the work you’ve put into the site will simply be gone.
Do you need immediate help with your hacked website? Then
call me or send me an email,
I'll get back to you right away.
How can I rescue my hacked WordPress website?
Of course, the easiest thing for you would be to contact me, and I'll take care of your website.
What should I do if my website has been hacked?
- First, I'll see if I can create a backup of the website—either through the backend using Duplicator or “manually.” If I download your data via FTP, my antivirus scanner will likely flag an infected file if one is found. Then I'll at least know where to look to regain access to the site, at least temporarily.
- Then I’ll try to log in to WordPress. If the entire WordPress site is down, I’ll replace the WordPress core files.
- Next, I’ll review the user accounts. If there are any suspicious users, they’ll be deleted in consultation with you. Passwords will be changed for all remaining accounts.
- Then, depending on the severity of the infection, I’ll start by updating everything that can be updated. The updates page should display a complete list here.
- Next, I’ll install a firewall. I’ve had very good results with wordfence. It allows you to scan the entire WordPress installation for infected and/or tampered files. To do this, the firewall compares the source code of the WordPress, theme, and plugin files with the originals and then suggests a course of action (e.g., delete, ignore, etc.).
- I check the plugins and themes in the backend and set everything that doesn't affect the frontend (e.g., Yoast SEO or an inactive default theme) to update automatically. In addition, WordPress itself should at least install security updates automatically.
- Then I take another backup of the system.
You find files and scripts on your server that don't belong there.
They usually look similar to WordPress files, but they don't belong there. You can only determine this if you look around on the server with an FTP program and know which files belong to WordPress. These can often be found in the “wp-content” directory.
Removing these files only helps temporarily, because the actual script that creates these files or saves them to your server is located somewhere else entirely. A few days later at the latest, a similar file will appear there.
Strange WordPress user accounts
If you see users in the list of users in the WordPress backend who seem strange to you and who have administrator rights, this may also indicate that a bot has hijacked the site. If the name doesn't make sense and the username, nickname, and public name are all identical, I would definitely say that this is unauthorized access. This user can make any changes to your site. You can revoke their rights by removing the administrator role until it is clear what purpose this user serves. Ultimately, you should delete them, of course. If you cannot do this in the backend, you must delete them directly in the database
Incorrect search results
If a different title or description suddenly appears in the search results for your page than the one you specified in the WordPress backend, this is also a sign that your website has been hacked. If you search for your own site on Google using “site:your-domain.com,” it is possible that your website will appear very far down the list, e.g., with
keyword: “something cryptic” | your website
Visits to your website suddenly drop significantly
A sudden drop in your website visitors is another indication. In this case, your visitors could be redirected to other websites with malware.
Or your website will be blacklisted by Google and classified as unsafe. You can prevent this with the Google transparency report.
Unknown scheduled tasks
Cron jobs are commands that can be given to a server to perform regular tasks. These cron jobs can also be set up for WordPress, for example, to publish scheduled posts or automatically empty the trash. If you use a plugin to monitor tasks in WordPress, you may find jobs in the list of cron jobs in WordPress that you are not familiar with. This could also indicate that the site has been hacked.
The home page of your website is broken or has minor errors.
Either the hacker has a small error in their bot that causes minor inconsistencies on the website, or it is the hacker's intention to let you know that they have hijacked your website. They will then post their own content on the website or perhaps try to blackmail you.
Your WordPress registration has failed
If you are sure that the login details you entered are correct, you should search for your username in the database. A hacker may have deleted or changed your backend account. If your account has been deleted, you will no longer be able to reset your password. You can create an administrator account directly in the database, but this will only prevent it from happening again once you have eliminated the source of the hacked WordPress.
Unusual activity on the server
You can check the server's log files to see if there have been any significant changes in traffic or errors on the server. A sudden increase or decrease in traffic, or an unusually high number of errors on the server, may indicate that the system has been hacked. Here, you may also be able to see where the attacks are coming from and block the IP addresses of the sources.