Document the symptoms
WordPress.org recommends identifying indicators of compromise instead of assuming all unusual behavior has the same cause.
- Record what users see and when it began.
- Note recent plugin updates, new users, changes in hosting and suspicious emails.
- Keep a copy of relevant notices from the host or search engine.
Do not publish private server logs or customer details.
Preserve recovery options
Evidence and backups make later investigation safer.
- Do not delete unknown files before their purpose is understood.
- Keep available site and database backups; verify whether they predate the incident.
- Contact the hosting provider if the account is suspended or the issue appears server-wide.
If the affected website processes payments or customer data, consider temporarily limiting affected functionality.
Restore control and plan prevention
Cleanup usually requires more than replacing visible content.
- Review privileged accounts and access methods.
- Ensure supported core and extensions are updated after the compromise is addressed.
- Check for persistence, unexpected tasks and repeated changes; review backups and monitoring.
It may be necessary to reset affected credentials using trusted devices once the environment is clean.
Relevant official documentation
These references inform the general guidance. They do not verify any individual site's condition.
Need someone to investigate?
You can describe the symptoms without identifying the cause yourself. Credentials are not requested in the public form.
Request a repair ↗