Has your WordPress site been hacked? Print

Discovering that your WordPress site has been hacked can be alarming, but having access to cPanel, WP Toolkit, Imunify360, and JetBackup gives you a complete set of tools to isolate, clean, and restore your site safely.

Step 1: Isolate the Site & Enable Maintenance Mode

Before starting any cleanup, isolate the site to prevent malware from infecting visitors or spreading across other domains in your account.

1. Log in to your cPanel dashboard.
2. Under the Domains or Applications section, click on WP Toolkit.
   
   
   
3. Locate your affected WordPress installation.
4. Toggle Maintenance Mode to ON. This stops public visitors from hitting malicious redirects while you work.
5. In WP Toolkit, click Check WordPress Integrity. This compares your core files against official WordPress.org hashes to flag modified core files.

Step 2: Scan and Clean Malware with Imunify360

Imunify360 is built directly into cPanel to locate and neutralise malicious PHP scripts, webshells, and injected code.

1. Return to the main cPanel Tools page and scroll down to the Security section.
2. Click on Imunify360.
   
   
   
3. Open the Malware Scanner tab.
4. Click Start scanning to perform a deep scan of your home directory.
5. Once the scan completes:

• Review the list of infected files under Malicious.
• Click Clean up all (or the individual gear icon next to each infected file) to automatically remove injected payload code or quarantine malicious standalone scripts.

Step 3: Restore from a Clean Backup (If Needed)

If the site remains broken after cleaning, or if malware modified too many core/theme files, roll back to a clean state using JetBackup.

1. In cPanel, navigate to the Files section and select JetBackup.
   
   
   
2. Choose File Backups or WordPress Backups:

• Select a restore point from 2–5 days ago (before the hack occurred).
• Click Restore next to your chosen date.

   3. Next, select Database Backups in JetBackup and restore the database corresponding to that same clean date.

Note: Restoring a backup will revert any posts or page changes made after that backup date, but it guarantees a known clean file system.

Step 4: Audit Users & Change Credentials

Once the site is back up and clean, secure all access points so the attacker cannot return:

1. Audit WordPress Users

• Open WP Toolkit or log into /wp-admin/.
• Go to Users and remove any administrator accounts you don't recognise. Attackers often create stealth admin users (e.g., system_admin, wp_support).

2. Reset All Passwords

• Change your cPanel account password.
• Change your WordPress Admin passwords (you can force a password reset directly from WP Toolkit under the Setup menu without logging into wp-admin).
• Change your Database user password via cPanel's MySQL Databases page (remember to update the DB_PASSWORD inside wp-config.php if you change this).

3. Reinstall Fresh Plugins and Themes

• Go to WP Toolkit -> Plugins / Themes.
• Update all plugins and themes to their latest versions to patch known security vulnerabilities.
• Remove any inactive plugins or nulled/pirated themes, as these are the primary vector for backdoors.

Step 5: Hardening & Prevention

To ensure the hack doesn't reoccur:

• Enable Automatic Updates: In WP Toolkit, enable Autoupdate settings for WordPress Core, Plugins, and Themes.
• Run Security Measures: In WP Toolkit, click Security and apply recommended measures (such as restricting access to xmlrpc.php, blocking directory browsing, and forcing HTTPS).
• Reset Security Keys (Salts): Generate new secret keys in your wp-config.php file (or use WP Toolkit's security hardening options) to invalidate all active session cookies across the web.