A hacked site may contain altered files, unauthorized accounts, injected scripts, or spam pages that are not visible from the homepage.
What to check
- Document every visible symptom
- Protect logs and a clean backup if available
- Replace compromised access and vulnerable components
What the results mean
Preserve logs and backups, investigate the entry point, remove the damage, and secure access before declaring the site clean.
Protect evidence and customer trust
Record malware warnings, redirects, modified pages, and unfamiliar users. Preserve logs, files, and database before a cleanup. If customer information or payments could be affected, identify the relevant systems and get appropriate incident guidance. Avoid simply reinstalling WordPress over a potentially compromised account.
Remove the entry point
Inspect plugins, themes, core files, uploads, database content, and privileged access. Replace compromised credentials, update vulnerable components, and verify the site in a clean environment. Check forms and search warnings after reopening. Continued monitoring matters because a backdoor can remain after visible spam disappears.
Can an old backup be restored?
Yes when it is verified clean, but a restore is incomplete if the original vulnerability or stolen access remains.
Greg Grigorian
If this issue affects inquiries or day-to-day work, get the cause checked and the important customer paths tested after repair. Greg can handle the website work directly.