First Steps After a WordPress Hack

1. Stop the site harming visitors

If the site is redirecting people, showing spam or offering downloads you did not add, every visit is a risk to someone. Containment comes first, and the OAIC's data breach guidance lists it as the first of four steps: prevent any further compromise ^[1].

The simplest options, from least to most disruptive:

• switch on a maintenance mode page from your host's control panel, if it offers one;
• ask your host to place the site behind a holding page or temporarily disable it;
• if you run paid ads, pause them so you are not paying to send people to a harmful page.

Avoid deleting the site or wiping the hosting account. That removes the problem from view but also removes the evidence and the content you need to bring back.

2. Take a copy of the site as it is

Before anyone cleans anything, download a full copy of the files and the database. Most hosting control panels have a backup tool that does both. If you cannot, ask your host to take one and keep it.

This copy matters for three reasons. It shows how the attacker got in and what they changed. It holds recent orders, enquiries and posts that may not be in older backups. And if customer data was involved, it is part of the record you may need when assessing a possible breach.

3. Change passwords from a clean device

Use a computer or phone you have no reason to distrust. If you suspect your own computer, use another one. Change passwords in this order:

1. the email account that receives WordPress and hosting messages;
2. the hosting control panel and any SFTP or file access logins;
3. your domain registrar account;
4. every WordPress administrator account, including ones you do not recognise, which should be removed once the copy in step 2 exists;
5. any payment, booking or email marketing service connected to the site.

Turn on multi-factor authentication wherever it is offered. Business Queensland's guidance describes it as requiring two or more proofs of identity to grant access ^[2], and the Australian Cyber Security Centre recommends turning it on wherever possible, starting with your most important accounts ^[3].

4. Write down what you have seen

Memories blur quickly under stress. Note when the problem was first noticed and by whom, what people saw, screenshots of any warnings, names of unfamiliar users or plugins, and anything your host has told you. If Google has flagged the site, open Search Console and note the issues listed in the Security Issues report, along with the sample addresses ^[5].

Our incident checklist turns these notes into a short text file you can keep or send to whoever helps you. It does not ask for passwords, and you should not add them.

5. Check whether customer data may be involved

Ask a simple question: did the website store or handle personal information, such as customer accounts, orders, enquiry form entries or newsletter sign-ups? If it did, the hack may also be a data breach.

For organisations covered by the Privacy Act, a breach is eligible for notification if it is likely to result in serious harm to one or more individuals and the risk has not been prevented with remedial action. If you only suspect an eligible breach, you must take all reasonable steps to complete an assessment within 30 calendar days ^[1]. Our guide to data breaches and hacked websites explains who is covered.

If a ransom or extortion payment has been made, there is a separate rule. Businesses whose annual turnover for the previous financial year exceeds $3 million must report the payment to the Australian Signals Directorate within 72 hours of making it ^[4]. See our ransomware payment reporting guide.

6. Get help with the cleanup

For advice on the incident itself, the Australian Cyber Security Centre runs a hotline on 1300 CYBER1 (1300 292 371), and Business Queensland describes it as available at any hour ^[2]. Cybercrime can be reported at cyber.gov.au/report ^[2]. Our guide to getting help from ReportCyber and IDCARE explains which service suits which problem.

For the website, choose someone who will copy the site before working on it, find the entry point rather than only removing symptoms, and give you a written report. That is how we run malware removal and recovery, but whoever you choose, ask those three questions.

Talking to customers and staff

People will notice before the site is fixed, so a short, honest message helps. For staff, explain that the website has a security problem, that it is being dealt with, and that they should not log in to the site or forward any suspicious emails about it. For customers who contact you, say the site is temporarily offline while a problem is fixed, and that you will let them know if any of their information was affected once that is known.

Avoid guessing in public. Saying "no customer data was involved" before anyone has checked can turn out to be wrong, and correcting it later is harder than waiting a day for the facts. If personal information may be involved, the OAIC's guidance on assessing a suspected breach applies before deciding what to tell people ^[1].

A simple log for the first day

When a site is hacked, the first day is usually a blur of logins, phone calls and messages. A short written log turns that into something you, your host and anyone helping you can rely on later. It does not need special software. A plain document or a page in a notebook works, as long as it is kept away from the affected site.

For each entry, write the date and time, who did what, and what they saw. Useful entries include:

• when the problem was first noticed, by whom, and how (a customer email, a browser warning, a host notice);
• each password changed, with the time, but never the password itself;
• when the copy of the site was taken and where it is stored;
• every message to or from the host, a payment provider or a support service, with any reference number;
• what the public could see at each point: the normal site, a warning page or a maintenance page.

This log has several uses. It helps whoever cleans the site understand the order of events. It gives you the facts you need if you later have to assess whether personal information was involved. And if you have cyber insurance, it gives the insurer a clear timeline instead of a reconstruction from memory. Our free incident worksheet covers the same ground and runs in your browser without sending anything to us.

What not to do

• Do not reinstall plugins one by one hoping the problem goes away.
• Do not restore a backup until you know when the break-in began.
• Do not email passwords to anyone, including people helping you.
• Do not request a Google review until every listed issue is fixed on every page, as Google asks ^[5].