Restoring a Hacked WordPress Site Without Reintroducing the Problem

When a WordPress site is hacked, the first instinct is to restore the latest backup. This is often a mistake: if done too late, it already contains the backdoor; if restored without closing the vulnerability, the site will be compromised again within days. This guide follows the recommended order from WordPress.org, Cybermalveillance.gouv.fr (the national assistance program for victims), and the Sucuri team, including the specific case of UpdraftCentral keys stolen in October 2026.

Before restoring: four actions

Take the site offline. Cybermalveillance.gouv.fr advises first disconnecting what is compromised: ask your host to put the site in maintenance mode or block access during the cleanup.

Preserve evidence. Server logs, screenshots, timestamps of what you observed, and the last actions taken on the site: document everything. These details help determine the intrusion timeline and support a police report if needed.

Make a copy of the current state. Files and database, off the server, before making any changes. This is for evidence, not for restoration.

Change access credentials. Administrator passwords, FTP or SFTP credentials, database access, and hosting panel passwords, then the secret keys in wp-config.php, which log everyone out. WordPress.org recommends redoing this after cleanup.

Choose the right backup

Determine the intrusion date. This is the key question. Four clues help: the creation date of unknown accounts, the modification date of recently altered files (your host’s file manager sorts them by date), the first suspicious request in access logs, and the appearance date of spam pages in Search Console.

Known dates from autumn 2026. For UpdraftCentral, use a backup from before October 17; for the Ninja Forms campaign, from before October 4; for Bricksforge, from before October 7; for the exploited core vulnerability (since September 22), from before that date if the site lacked the patch.

Verify the backup before using it. Open it and check the plugins list and the wp-content/uploads folder: a backup already containing the suspicious plugin or a .php file in uploads is useless.

If no backup is old enough. You must clean up manually: it takes longer, but the following steps still apply.

Restore cleanly

The heart of WordPress, refreshed. WordPress.org advises reinstalling the same version of WordPress via FTP or SFTP, not using the admin reinstallation button, which only overwrites existing files and leaves added files in place. The wp-admin and wp-includes folders are completely replaced with a clean copy.

Plugins and the theme, from their source. Sucuri recommends reinstalling them from wordpress.org or from the editor’s website, rather than restoring them from a backup. Do not blindly replace the wp-content folder or the wp-config.php file: they contain your content and settings.

Files to review. WordPress.org mentions .htaccess and index.php, and in the theme, header.php, footer.php, and functions.php: these are where redirects often hide. In the database, Sucuri advises searching for eval, base64_decode, gzinflate, and shell_exec, which have no place in page content.

Just after: close the door.

Update immediately. A backup also restores old versions, meaning the vulnerability through which the attacker gained access. Update WordPress (to 7.1.3 or the latest version of your branch), the theme, all plugins, and the PHP version with your host, before putting the site back online.

Remove the UpdraftCentral key again. A backup from before October 17 still contains the old key: WP Staging recommends removing it right after restoration, then resetting passwords and secret keys again. The procedure is in my UpdraftPlus guide.

Change passwords a second time. All of them, including the database, as WordPress.org recommends.

Clear the alerts. In the Search Console, once the site is clean, request a review from the Security Issues report. If the host had suspended the site, inform them of the actions taken.

After bringing the site back online

Understand how the attacker gained access. Without an answer to this question, the same door remains open: outdated plugin, reused password, UpdraftCentral key, forgotten FTP account. WordPress.org places this analysis right before site hardening.

A routine. A backup off the server every week, checked occasionally by performing a real restoration on a copy; updates every month; two-factor authentication for every administrator; unused extensions removed.

The steps. If the site holds personal data, notification to the CNIL must be made within 72 hours as soon as there is a risk to individuals. The Cybermalveillance.gouv.fr guide states that the CNIL considers website defacement as a breach of personal data and also advises filing a complaint and seeking professional help.

Frequently Asked Questions

My last backup was made after the hack: what should I do?
Clean up on-site, using the same method: core reinstalled from scratch, extensions and theme from their original source, unknown accounts and files removed, database reviewed. It takes longer than a restoration, and the outcome depends on what was found: a new check within the following weeks is essential.

How long does it take?
For a showcase site with a good backup, plan for half a day of work. For an online store, or a site without usable backups, more time will be needed.

How much does professional restoration cost?
For me, updating a site starts at 190 €; cleaning and restoration are priced after a free diagnosis, as they depend on the site’s condition and backups. The details are on the remote intervention page.

Should I notify my clients?
If their data could have been accessed and the risk to them is high, yes: it’s a requirement, in addition to notifying the CNIL. A showcase site with no recorded data has nothing to report.

Need a hand?

Start by checking your site for free, then follow today’s verification steps. If the result worries you, or if you don’t know which backup to choose, I’ll take a look within 24 hours and tell you what I see, for free. If you entrust me with the restoration, I’ll write down exactly what was done, step by step.

Sources: FAQ « My site was hacked », WordPress.org, quick-reference guide on website defacement, Cybermalveillance.gouv.fr, 7 steps to remove malware from WordPress, Sucuri, cleaning a hacked WordPress site, Sucuri, UpdraftCentral incident, guide by WP Staging, October 2026 incident, TeamUpdraft, reporting a personal data breach, CNIL.