Restore a Hacked WordPress Site from a Clean Backup

Restoring a hacked WordPress site from a clean backup is the most reliable way to remove malicious code and get your site back to a known-good state. This guide walks you through the entire process—from preparing your backup and cleaning your hosting environment to restoring files and database, then securing your site to prevent reinfection. You’ll need access to your hosting control panel (cPanel, Plesk, or similar), an FTP client (like FileZilla), and your clean backup files.

What You’ll Need

• A clean backup of your WordPress site (files and database) taken before the hack. If you don’t have one, you’ll need to manually clean the site instead.
• FTP/SFTP client (e.g., FileZilla) or access to your hosting file manager.
• Access to your hosting control panel (cPanel, Plesk, etc.) to manage databases and files.
• phpMyAdmin or similar database management tool (usually available in your control panel).
• A code editor (like Notepad++) for editing configuration files if needed.
• Your WordPress admin login credentials (or the ability to reset them via the database).

Step-by-Step

1. Confirm the hack and identify the backup date. Check your site for signs of compromise (unexpected content, redirects, malware warnings). Determine the last known clean backup date. If you have multiple backups, choose the one closest to the hack date but before any suspicious activity.
2. Put your site into maintenance mode. This prevents visitors from interacting with the compromised site while you work. You can do this by adding a temporary maintenance.php file in your theme directory or using a plugin if you can still access the admin dashboard. If not, edit your .htaccess to show a 503 error or use a hosting-level maintenance page.
3. Download a fresh copy of WordPress core files. Go to wordpress.org and download the latest version of WordPress. You’ll use this to replace the core files, ensuring no malicious code remains in them.
4. Back up the current (hacked) site for forensic analysis (optional but recommended). Before deleting anything, download a full copy of the hacked files and database. This can help you understand how the hack happened and prevent future attacks.
5. Delete all WordPress files from your server. Using FTP or your hosting file manager, delete all files in the WordPress root directory (e.g., public_html or www). Do not delete the directory itself, and be careful not to delete other files outside the WordPress folder (like other scripts or backups stored there).
6. Upload the clean backup files. Upload the files from your clean backup to the empty directory. If you have a full backup (all files), upload them all. If you only have a partial backup (e.g., only wp-content and wp-config.php), upload those and then upload the fresh WordPress core files you downloaded in step 3, overwriting the default ones.
7. Restore the database. Log into phpMyAdmin (or your database tool). Select the database you use for WordPress. If you have a backup of the database, drop all existing tables (or the entire database) and then import your clean backup SQL file. If you don’t have a database backup, you’ll need to clean the existing database manually (remove suspicious users, options, and content).
8. Update wp-config.php if necessary. If your database name, username, or password changed, edit wp-config.php to reflect the correct values. Also, ensure the WP_HOME and WP_SITEURL constants are correct or remove them to let WordPress auto-detect.
9. Check file permissions. Ensure that directories are set to 755 and files to 644. You can do this via FTP or a terminal command. Incorrect permissions can cause security vulnerabilities.
10. Log into your WordPress admin. Try to access yourdomain.com/wp-admin. If you can’t log in, you may need to reset your password via phpMyAdmin (update the user_pass field with an MD5 hash of a new password).
11. Update everything. Once logged in, update WordPress core, all themes, and all plugins to their latest versions. Outdated software is a common entry point for hackers.
12. Change all passwords. Change the admin password, all user passwords, your FTP password, database password, and hosting account password. Use strong, unique passwords.
13. Scan your site for residual malware. Use a security plugin (e.g., Wordfence, Sucuri) or an online scanner to verify that the site is clean. Even after restoration, a thorough scan is essential.
14. Remove any suspicious files or users. Check for any unknown admin users in your database and delete them. Look for any suspicious files in your uploads directory or root folder (like PHP files in unexpected places).
15. Take the site out of maintenance mode. Remove the maintenance file or revert the .htaccess changes. Test your site thoroughly to ensure everything works.

Common Mistakes

• Restoring a backup that is also infected. If your backup contains malicious code, you’re back to square one. Always verify your backup is clean before restoring.
• Not cleaning the server environment. If the hack planted a backdoor outside the WordPress directory (e.g., in a cron job or a different folder), simply restoring WordPress won’t remove it. Check cron jobs, server logs, and other files in your hosting account.
• Ignoring the need to change all passwords. If you don’t change passwords, the attacker can simply log back in.
• Using the same backup that contains the exploit. If the hack happened weeks ago and your backup is from that time, it’s not clean. Use the oldest clean backup you have.
• Skipping updates after restore. Restoring an old backup means you’re running outdated software. Update immediately to patch known vulnerabilities.

Tips

• Keep multiple backups. Store backups offsite (like in cloud storage) and keep several versions (e.g., daily, weekly, monthly). This gives you more options when choosing a clean restore point.
• Use a security plugin. Install a reputable security plugin that provides file integrity monitoring, login protection, and malware scanning.
• Limit login attempts. Enable two-factor authentication and limit login attempts to prevent brute-force attacks.
• Remove unused themes and plugins. Delete any themes or plugins you don’t use—they are potential entry points.
• Keep everything updated. Set up automatic updates for WordPress core, plugins, and themes.
• Use a reliable backup plugin. Consider using a backup plugin that automates backups and stores them offsite.

Troubleshooting

• Site shows a blank page after restore. This usually indicates a PHP error. Enable WP_DEBUG in wp-config.php (set define('WP_DEBUG', true);) to see the error. Common causes: missing files, incompatible plugin, or incorrect database credentials.
• Cannot log into wp-admin. If you get “Error establishing a database connection,â€� check your wp-config.php database settings. If you get a login loop, try resetting your password via phpMyAdmin or use the “Lost your password?â€� link (if email works).
• Database import fails. If the SQL file is too large, split it into smaller parts or use a tool like BigDump. Ensure the database character set matches (usually utf8mb4).
• Site still redirects to malicious pages. This could be due to a browser cache or a malicious redirect in the database (e.g., in the options table). Check the siteurl and home options in wp_options. Also, clear your browser cache and try a different browser.
• Files are corrupted after upload. Re-upload the files, ensuring the FTP transfer is set to binary mode. If using a zip archive, extract it on the server using the hosting file manager to avoid corruption.
• Security plugin flags files as malicious. If a plugin flags a file that you know is from a clean backup, it might be a false positive. Compare the file hash with the official WordPress repository or the theme/plugin developer.

Frequently Asked Questions

What if I don’t have a clean backup?

If you don’t have a clean backup, you’ll need to manually clean the site. This involves scanning for malicious code, removing unknown users, and updating everything. It’s more complex and time-consuming, but possible. Consider hiring a professional if you’re not comfortable.

Can I just reinstall WordPress instead of restoring a backup?

Reinstalling WordPress core will replace core files, but it won’t remove malicious code from your uploads, themes, or database. You’d still need to clean those areas. A full restore from a clean backup is more thorough.

Will I lose my content if I restore from a backup?

Yes, you’ll lose any content (posts, pages, comments, settings) that were created after the backup date. That’s why it’s crucial to have recent backups. If you have a database backup from just before the hack, you’ll only lose content from the hack period.

How do I know if my backup is clean?

Scan the backup files with a malware scanner on your local computer. Also, check the backup date—if it’s before the hack, it’s likely clean. You can also compare file hashes with the official WordPress distribution.

What should I do after restoring to prevent future hacks?

Change all passwords, update everything, remove unused themes/plugins, install a security plugin, enable two-factor authentication, and keep regular backups. Also, consider moving to a more secure hosting provider if your current one is often compromised.

Should I inform my users about the hack?

If the hack involved user data (like email addresses or passwords), you may be legally required to notify users. Even if not, it’s good practice to inform them and advise them to change their passwords if they reused them elsewhere.

Related

• AI Agents in Smart Cities: How They Work
• How to Choose Tactical Pants for Cold Weather Work
• Prediction Markets vs Hedging: Key Differences