Have you ever had your WordPress site hacked and did you have to pay somebody to restore it? Here's our 21-step process to restore a hacked WordPress site.
It’s a bit of a mare when your website gets hacked.
Most security specialists will charge you a premium to restore your site but they won’t tell you what’s involved. Shhhhh – it’s a secret!
Here at Zero Point Development, we’re different so I’d like to share our 22-step plan on how to restore a hacked WordPress site so that you can see exactly what we do and how much effort it takes.
The step process
- zip up the entire remote site files and download to local
- wipe the remote root folder (everything goes)
- Change FTP, cPanel, email account and MySQL passwords
- unzip local site and scan for any malware using, say Norton IS or SpyBot
- search all the local site file contents for terms such as preg_replace(“/.*/e” and base64_decode
Note: there are legitimate uses base64 decoding. What you are looking for are a large number of hex or escape strings
- do a windows search across the local folder for timthumb.php – if found – you need to scrap the plugin and find an alternative – read why timthumb.php is evil !!
- check that your .htaccess file hasn’t been compromised and check that there are no other .htaccess files in any other folder (windows search)
- create a new separate root folder and unzip latest wordpress version there
- copy your wp-config.php fom the old site over to the new folder
- change your DB_PASS and your secret keys
- upload new clean bare WP to remote site
- login to WordPress and immediately change all user passwords – try to use random password generator like https://www.vpnmentor.com/tools/secure-password-generator/ and bump the characters up to 12 or 16
- install the “WordFence” firewall plugin
- if you don’t want to install a full firewall plugin (whaaat are you nuts? Your site just got hacked!) at the very least install “Limit Login Attempts Reloaded” plugin and set to 3 attempts
- create a new administrator user. Hint: don’t call it Admin, Sys, System, Administrator, Operator, WordPress or anything like that
- delete the old administrator users making sure the posts/pages are inherited by the new administrator user created in the previous step
- now you have a working and secured core WP installation
- reinstall all the plugins from the Admin Dashboard and reactivate them if WP has already had them deactivated. The settings should be already stored in the DB
- upload / ftp your theme to the live server and reactivate the theme. Theme settings should be picked up from the DB but I’ve had instances where you have to set up menus again – bad theme!
- last to upload / ftp is your wp-content/uploads (and any other non-WP folders in there after checking they are OK and contain only the correct media)
Note: this is a favoutire place for hackers to store their .php or .cgi scripts sometimes named “cache”
- I recommend using xcloner as a backup tool and setting up a cPanel crontab job to perform your backups. Either ftp them to another site or purchase an Amazon S3 storage bin – it’s ultra cheap
Depending on how familiar you are with WordPress and hosting control panels and how many plugins and uploads a site has, this process is very time consuming. Restoration time depends on how many files make up your website as they all need to get checked.
We provide a hacked WordPress website restoration service if you don’t have the required technical skills or time to do it in.
And once your site is up and running again you may want to start putting into place some extra web security policies and processes.
Has your WordPress site been hacked recently? Tell us your story.