Store’s redirecting to something dodgy, or Google’s flagged it, or your host just suspended the account for malware. It’s a bad morning. The instinct is to start deleting files and reinstalling things as fast as possible. Don’t — that’s how you lose the one thing you need most. Here’s the calm first hour, in order.
1. Contain it — but don’t nuke it
Put the store into maintenance mode or take it offline so customers aren’t served malware and Google isn’t crawling the compromise. But do not start mass-deleting files yet. If you wipe everything before you understand how they got in, you’ll clean the symptom, miss the entry point, and get reinfected within days. I’ve seen it happen more than once.
2. Preserve the evidence
Take a full snapshot first — files and database — and set it aside. This is your crime scene. You’ll want the attacker’s added files, the modified timestamps and the logs intact so you can actually trace what happened. Cleaning destroys evidence; snapshot before you clean.
3. Lock the doors
Rotate everything an attacker could be holding: all admin passwords, the database password, hosting and FTP/SSH credentials, and any API keys. Force a logout of all sessions. If they still have a valid login or a live key, cleaning the files just gives them a fresh canvas.
4. Find the entry point
This is the part that separates a real recovery from a temporary one. You’re looking for how, not just what:
- Recently modified files — sort by modification time and the injection usually stands out.
- Server access logs around the time things changed — suspicious POST requests, odd user agents, hits to files that shouldn’t exist.
- Known vulnerabilities — an outdated plugin or theme with a public CVE is the most common way in. Check versions against known issues.
- Rogue admin users and unexpected scheduled tasks.
5. Clean, then harden
Now you clean — remove the injected code from files and database, replace core, plugins and themes with known-good copies, and remove the backdoors (there’s almost always more than one). Then close the door you found in step four: update or remove the vulnerable component, tighten file permissions, remove abandoned plugins and themes that were never the point but were the way in, and add sensible login protection. Cleaning without hardening is just scheduling the next incident.
6. Get back in Google’s good books
If you were blocklisted or flagged in Search Console, request a review once you’re genuinely clean — not before, because a failed review sets you back. Then keep an eye on the logs for a couple of weeks.
The whole thing is calmer and faster when it’s done in this order rather than in a panic. If you’re staring at a compromised store right now and don’t want to guess, that’s exactly what hacked-site recovery is for — I’ll get you back online and then make sure it doesn’t happen again. And once you’re stable, a store audit catches the other doors before someone else does.