Question 1

What's the first step when a WordPress site gets hacked?

Accepted Answer

The first thing we do is look for a clean backup from before the infection. If one exists and restoring from it won't cause unacceptable data loss, that's almost always the fastest path back online. A rebuild is the last resort, not the first move.

Question 2

When would you rebuild a hacked site instead of restoring from backup?

Accepted Answer

A rebuild makes sense when no usable backup exists, when the oldest available backup is already infected, or when restoring from backup would mean losing important data like orders or form submissions that can't be recreated. In those situations, going straight to the database to extract clean content and rebuilding on a fresh install is the better option.

Question 3

How do WordPress sites get infected with malware?

Accepted Answer

The first thing we do is look for a clean backup from before the infection. If one exists and restoring from it won't cause unacceptable data loss, that's almost always the fastest path back online. A rebuild is the last resort, not the first move.

Question 4

How can I prevent my WordPress site from being hacked?

Accepted Answer

Three things cover most of the risk: keep plugins updated promptly, maintain regular offsite backups, and have someone actively monitoring the site. Most attacks exploit known vulnerabilities that already have patches available. If nobody is applying those patches, it's just a matter of time.

Case Studies

Hacked WordPress Site? How to Decide Between a Cleanup and a Full Rebuild