My WordPress site was hacked. What should I do?
Contact your host or incident-response provider to contain the compromise, preserve relevant files and logs, and recover from a verified safe state. If personal information may be involved, get advice promptly about investigation and notification responsibilities.
The longer version
Containment, preservation and recovery need to be coordinated. Depending on the incident, this may include restricting access, preserving a copy, reviewing logs and rotating affected credentials through a trusted environment.
Recovery should address the entry point as well as the visible damage. A backup needs to be checked before use so that recovery does not restore the same compromise.
Next steps
- Contact the host or response provider and agree on containment.
- Preserve relevant evidence and identify affected systems and data.
- Review credential changes, recovery and the original entry point.
- Obtain advice about any required notifications before returning to normal operation.
Related guides
Sources
- Security Breach Notification Laws (opens in a new tab)National Conference of State Legislatures
This page provides general information. Your obligations depend on your business and jurisdiction. Consult a qualified adviser about your circumstances.