First: breathe. Panic-deleting things destroys the evidence you need. Work the checklist. 🧯
- Contain. Take the site offline (maintenance mode / temporarily point to a holding page) so it can't harm visitors or send spam.
- Change every credential — hosting, SFTP, database, CMS admin, and any reused passwords. Assume they're all burned.
- Find the entry point before restoring. Usually an outdated plugin/theme, a weak password, or a known CMS vuln. Check access logs around the first sign of trouble.
- Restore from a known-clean backup — one from before the compromise. This is why dated, tested backups matter.
- Patch everything, then scan (server-side malware scan, not just a plugin) to confirm it's clean.
- Harden: 2FA, least-privilege users, a WAF, auto-updates for security releases.
- If you were blacklisted, request review (Google Search Console, etc.).
Don't just delete the one bad file you found — hacks leave backdoors in plural.
Dealing with one now? Post your CMS and what you're seeing (redact anything sensitive) and we'll help you triage. 🛟
