Engineering Case Study
Cleaning Up After a WordPress Compromise: A Systematic Approach
A hacked WordPress site is stressful. The instinct is to start deleting suspicious files immediately — but without a systematic approach, you risk missing hidden malware, losing data, or cleaning the same site twice. This article outlines a repeatable methodology for triage, cleanup, and prevention that holds up across different compromise types.
Detection
Compromises aren't always obvious. Common signals include:
- Unexpected file changes
- Plugins or themes you didn't install
- Unusual or unrecognized admin users
- Alerts from external scanners like Sucuri
- Redirect behavior you didn't configure
- Spam injection showing up in search results
Experienced developers often catch compromises through pattern recognition before automated tools surface them — which is one reason having an ongoing developer relationship with your site matters. For everyone else, running periodic external scans and monitoring file changes are your early warning system.
Triage First
Before touching anything, assess scope. What's been affected — the filesystem, the database, active sessions, admin accounts? Understanding the full extent of the compromise informs everything that follows and prevents you from cleaning one area while missing another.
Document what you find before you start cleaning. You'll want a record of what the compromise looked like.
Build and Maintain a Toolkit
When you solve a tough hack, save the tools you built to do it. Every difficult compromise expands your arsenal. Over time, a solid toolkit grows to include:
- Filesystem checking scripts — scanning for injected code, unexpected files, and modified core files
- Database checking scripts — checking for malicious content, unauthorized admin accounts, and injected redirects
- Site maintenance tools — utilities that actively keep sites clean, like plugin whitelisting
When you encounter a new attack pattern and build something to catch it, keep it. The next site with a similar compromise will be faster to clean. A toolkit you've built over real incidents is more useful than generic solutions because it reflects attack patterns you've actually seen.
Cleanup Protocol
Work in this order and don't skip steps:
1. Change all credentials and disconnect sessions Change all passwords immediately — WordPress admin, FTP, database, hosting panel. Disconnect all active sessions if your environment supports it. This cuts off active access before you start cleaning. 2. Reinstall WordPress from scratch Actually delete the WordPress installation rather than overwriting it. Hidden files can survive an overwrite. Delete the installation directory, then install fresh from a clean download. 3. Replace plugins at the FTP level Don't use the WordPress admin to reinstall plugins — it's slower and risks triggering compromised code during the process. At the FTP level, delete the plugin folder entirely and move a fresh copy over. This preserves your data while ensuring the plugin files are clean. 4. Audit and clean user accounts Remove any admin accounts you don't recognize. Keep your user list narrow — only accounts that need to exist should exist. This is ongoing maintenance, not just post-compromise cleanup. 5. Scan filesystem and database systematically Run your toolkit against both the filesystem and the database. Don't assume cleaning visible files is sufficient — database injections are common and easy to miss without a deliberate scan.Prevention
The cleanest hack is one that never happens. The most common entry points are outdated software and compromised credentials.
Keep everything updated WordPress core, plugins, and themes should be updated promptly. Vulnerabilities in outdated plugins are among the most common compromise vectors. Keep your plugin and theme inventory narrow Every plugin is a potential attack surface. Remove plugins and themes you're not actively using. Audit what's installed periodically. Whitelist approved plugins Rather than relying on manual audits alone, build tooling that flags plugins outside your approved list. This catches unauthorized plugin installation, which is a common compromise indicator. Build themes using current WordPress technologies Especially anywhere data integrity is involved. Legacy approaches to data handling introduce vulnerabilities that modern WordPress patterns address. Restrict file uploads If possible, don't allow forms to accept file uploads to your system at all. If uploads are required, restrict file types strictly. Unrestricted file uploads are a significant attack vector. Maintain a backup strategy Run periodic backups and keep a clean copy of the site from its original launch. If you need to revert to a clean state, a recent backup is significantly less painful than rebuilding from scratch. A launch-day copy gives you a known-clean baseline to compare against.The Toolkit Mindset
WordPress security isn't a one-time event — it's ongoing. The developers who handle compromises most effectively are the ones who treat each incident as an opportunity to build something reusable. A filesystem script that caught a PHP injection this month will catch the next one faster. A database check that surfaced a malicious redirect becomes part of your standard process.
Over time, the toolkit becomes the methodology. The goal isn't just to clean a compromised site — it's to build the capacity to clean the next one faster and catch the one after that before it does damage.
Council Perspectives
The council reviewed the problem from five different angles. My responses add the operational context behind each observation.
Julie: Compromises are infrequent enough that the documented process helps me remember every check too. It supports the whole team without pretending that any of us should rely on memory under pressure.
Julie: Our documentation is critical to keeping the response on track. It gives the team a stable sequence when the incident itself is creating urgency and noise.
Julie: At 4:30 on a Friday afternoon, no one should be trying to reconstruct a security response from memory. That is exactly when a clear checklist earns its keep.
Julie: I do see it as a challenge: stay ahead of attackers where I can, and when a breach comes through something outside my control, understand it quickly enough to take back the advantage.
Julie: You may still carry much of the load, but you should never be the only support holding up the wall while you are also trying to repair it.