June 30, 2026 · WordPress Security · Automated Recovery

WordPress Site Hacked? The Automated Recovery Process — No Plugins Required

What Happened to Sarah

Sarah manages 14 properties across Manchester. Her entire business runs through her WordPress site — tenants browse listings, book viewings, fill in application forms, pay holding deposits. On June 28th she Googled her own agency name to check something, clicked through, and landed on a page written in Vietnamese advertising online gambling. Same URL. Completely different content. Seven phantom admin users had appeared in her WordPress dashboard. Google was showing "This site may be hacked" under her search result.

Her phone started ringing. Tenants couldn't access the booking system. She lost two viewings before lunch.

Sarah is not unusual. According to security researchers at HideMyWP Ghost, 13,000 WordPress sites are hacked every day. The security company Sucuri reports that 95.5% of all infected websites they clean run WordPress. This is not because WordPress is insecure — it is because WordPress is everywhere. W3Techs tracks it powering 42.4% of all websites on the internet. When you are the biggest target, you take the most hits.

Why WordPress Gets Hacked

It is almost never WordPress core. The WordPress core team patches vulnerabilities aggressively. The problem is everything else — the plugins, the themes, the abandoned admin accounts, the hosting configurations that leave XML-RPC wide open.

Patchstack, a WordPress security company that tracks vulnerability data across the ecosystem, reported 7,966 new vulnerabilities in the WordPress ecosystem in 2024 — a 34% increase over the previous year. Weboptimo's analysis found that 92% of successful WordPress attacks come through plugin and theme vulnerabilities, not WordPress itself.

And the threat is evolving faster than most business owners realise. In April 2026, someone bought 30 established WordPress plugins from their original developers, injected backdoors into all of them, and pushed malicious updates to thousands of sites in a single day. The security firm Anchor.host documented the attack as it unfolded. The plugin names were trusted. The update notifications looked normal. The backdoors gave the attacker full admin access to every site that updated.

Sarah did not know any of this. She paid for managed WordPress hosting. She assumed someone was watching. Nobody was.

Why Sarah Did Not See This Coming

Sarah paid £29 per month for managed WordPress hosting. She assumed security was included. It was not — not the kind she needed. Her host kept WordPress core updated and ran a server firewall. They did not monitor her plugin versions. They did not audit her user accounts. They did not notice when seven new admin accounts appeared over three weeks because nobody was looking at the WordPress users table. Hosting security and application security are different products, sold by different companies, and the gap between them is where most WordPress hacks happen.

She also had a security plugin installed — a reputable one, kept up to date. It did not stop the attack because the attacker entered through a plugin vulnerability that the security plugin did not cover, created an admin account using a compromised password from an old data breach, and then disabled the security plugin from inside WordPress. By the time Sarah noticed the casino redirect, the security plugin had been silent for two weeks.

The Old Way: A 10-Step Checklist Written for Developers

When Sarah asked Siri "my WordPress site got hacked what do I do" at 7:14 that morning, the top results all gave her the same answer: a 10-step checklist. Stay calm. Take your site offline. Change all passwords. Scan for malware. Check your users table. Reinstall WordPress core. Reinstall themes and plugins. Clean the database. Submit to Google Search Console. Harden everything.

Here is the problem with that checklist: it was written for developers. Sarah runs a letting agency. She does not know what a users table is. She cannot reinstall WordPress core without risking her content. She does not know what XML-RPC is or why disabling it matters. Every step on that checklist is a landmine for someone who is not a WordPress developer — and a time sink for someone who is.

The checklist also misses the most dangerous threat: dormant backdoors. A hacker who has admin access can plant code that sits silently for weeks, waiting for a specific trigger — a date, a referrer, a user agent — before activating. Signature scans will not find it because it does not match any known malware pattern. Only behavioural analysis — asking "does this file have a legitimate reason to be here?" — catches it.

How Automated Recovery Actually Works

Automated WordPress hack recovery is not a plugin. If your site is already compromised, installing another plugin is like putting a new lock on a door that the burglar still has the key to. External recovery connects to your site through your hosting control panel or SFTP — the same way you would — and runs a five-phase pipeline that does not depend on WordPress being functional.

Phase 1: Forensic Snapshot

Before anything is touched, the system captures a complete record of your server state — every file, every database table, every user account, every cron job, every active process. This is your insurance policy. If something goes wrong during cleanup, we roll back to this exact moment. It also preserves evidence. If you need to file a police report, an insurance claim, or a complaint with the ICO about a data breach, you have a timestamped forensic record of exactly what was on your server.

Phase 2: Malware Signature Scan

Every file on your server is compared against known malware signatures — obfuscated PHP shells using eval(base64_decode(...)) patterns, injected JavaScript redirects hidden in header.php and footer.php, modified .htaccess rules that silently redirect your search traffic to spam sites, plugin files whose checksums do not match their official WordPress.org versions. Security plugins try to do this from inside WordPress. If WordPress is compromised, the plugin is compromised. External scanning operates at the file-system level — it sees everything, including files the hack has deliberately hidden from WordPress.

Phase 3: Behavioural Analysis

This is where automated recovery pulls ahead of manual cleanup. A human reading a checklist can spot an obvious casino redirect. But what about a file called wp-cache-legacy.php that was modified at 3:14am on a Saturday, contains 47 lines of base64-encoded PHP, and sits in your theme directory with the same permissions as legitimate files — but was never part of your theme? A checklist will never flag it. Behavioural analysis will. The system scores every anomaly across four dimensions — temporal, relational, structural, and network — and flags anything that cannot explain its own existence.

Phase 4: Clean Removal

Not quarantine. Not "disable the plugin and hope." Surgical removal — the malicious code is excised, WordPress core files are restored from verified checksums, database injections are reversed. You receive a before/after diff showing every line that was added, modified, or removed. This is your evidence that the cleanup was complete.

Phase 5: Hardening

After the site is clean, the system applies hardening. This is the phase that DIY recoveries almost always skip — not because it is difficult, but because after 11 hours of forensic investigation and manual cleanup, you are exhausted and you just want your site back online. That is exactly when the next hacker finds you.

The hardening profile covers seven specific changes. Two-factor authentication is enforced on every account with administrator or editor privileges — no exceptions, no "remind me later." File permissions are locked down: wp-config.php becomes read-only for the web server user, the uploads directory loses execute permissions, and wp-content is restricted to prevent direct PHP execution from uploaded files. XML-RPC — a legacy WordPress feature that enables remote publishing but is also the number one vector for automated brute-force attacks — is disabled at the server level, not through a plugin toggle that can be re-enabled. The database prefix is changed from the default wp_ to a random string, neutralising SQL injection attacks that target default table names without needing to scan. Login rate limiting blocks IP addresses after five failed attempts within 15 minutes. WordPress core updates are set to automatic. And a weekly external scan schedule is configured to compare every file against its last known clean checksum — so if a single byte changes where it should not, you know within hours, not days.

None of these steps require a plugin. None of them add a performance penalty. And all of them survive WordPress core updates. The hardening is applied once and persists until someone deliberately reverses it.

The Economics of a Hack

What Happens After Recovery

Sarah's site was clean in under four hours. The seven phantom admin accounts were gone. The casino redirect was excised — not disabled, removed at the file-system level. Two-factor authentication was active on her account and her assistant's. Google removed the "This site may be hacked" warning within 36 hours. Her booking pipeline was back online by the afternoon.

She now pays £49 per month for ongoing monitoring. Every week, an external scan compares every file, every database table, every user account against a clean baseline. If anything changes, she gets a Telegram alert before she would have noticed it herself. She has not had a security incident since. She told us something that has stuck with us: "I did not even know my site was vulnerable. I thought because I paid for hosting, someone was watching this. Now I know someone actually is."

That is the real gap in WordPress security. Not the code. Not the plugins. The gap is that most business owners do not know they are responsible for application security — and they find out the hard way, like Sarah did, on a Thursday morning when their site redirects to Vietnamese casino spam.

What to Expect When You Contact Us

What to Expect When You Contact Us

You describe the problem. "My site is showing casino spam." "Google says this site may be hacked." "I cannot log into my admin panel." You do not need to know technical terms. You do not need to follow a checklist. We take a forensic snapshot, run the five-phase pipeline, and deliver a clean, hardened WordPress installation — typically within three hours. You get a report showing exactly what was removed, what was hardened, and confirmation that Google Search Console review has been submitted. You did not install a plugin. You did not learn what a users table is. You described the problem, and we handled everything else.

Sources

1. W3Techs — CMS Market Share 2026. WordPress: 42.4% of all websites.
2. Sucuri via WebsiteSetup — Website Security Statistics 2026. 95.5% of infected sites run WordPress.
3. Patchstack — State of WordPress Security 2025. 7,966 new vulnerabilities in 2024, up 34%.
4. HideMyWP Ghost — WordPress Security Statistics 2025-2026. 13,000 sites hacked daily. Median exploit time: 5 hours.
5. Anchor.host — 30 WordPress Plugins Compromised in Supply Chain Attack, April 2026.
6. Weboptimo — WordPress Security in 2025/2026. 92% of breaches via plugins and themes.

Tags: WordPress Security · Hack Recovery · Malware Removal · Automated Recovery · Small Business · Site Hardening