Curated resource guide
WordPress Malware and Incident Response
Respond to a compromised WordPress site methodically, from initial triage through recovery and monitoring. These resources cover evidence preservation, containment, backdoors, database injections, malicious users and cron jobs, log and checksum analysis, safe cleanup, credential rotation, root-cause patching, and post-incident checks.
Scope
What this guide covers
- Compromise detection
- triage
- containment
- preserving evidence
- identifying initial access
- malicious admin users
- modified core/plugin/theme files
- web shells
- backdoors
- database injections
- rogue cron jobs
- mu-plugins
- wp-config.php changes
- .htaccess/server rules
- uploads abuse
- JavaScript redirects
- SEO spam
- credential theft
- log review
- checksums
- malware scanners
- cleanup
- password/key rotation
- patching root cause
- restoring safely
- persistence checks
- post-incident monitoring
- and documenting incidents
Selected references
Curated resources
Links open the original publisher so you can use the complete, current material in context.
- 01Recommended starting point
FAQ: My Site Was Hacked
A practical WordPress recovery checklist covering containment, credentials, cleanup, and prevention.
wordpress.org - 02
WordPress Monitoring
The official WordPress overview of file, traffic, behavior, and integrity signals worth watching.
developer.wordpress.org - 03
wp core verify-checksums
Detect modified Core files by comparing them with published WordPress checksums.
developer.wordpress.org - 04
NIST Cybersecurity Framework
Use a risk-based structure for identifying, protecting, detecting, responding to, and recovering from incidents.
nist.gov - 05
Wordfence Hacked Site Guide
A WordPress-specific vendor workflow for scanning, reviewing changes, cleaning, and strengthening a compromised site.
wordfence.com - 06
WordPress Backups
Start with the official model for protecting both the database and files required to reconstruct a WordPress site.
developer.wordpress.org - 07
CISA Known Exploited Vulnerabilities Catalog
Prioritize vulnerabilities backed by evidence of real-world exploitation rather than severity scores alone.
cisa.gov - 08
NIST Incident Response Guide
Structure preparation, detection, response, recovery, and improvement around current incident-response guidance.
csrc.nist.gov - 09
CISA Ransomware Guide
Plan resilient backups, containment, and recovery around the failure modes of destructive compromise.
cisa.gov - 10
WP-CLI Plugin Checksums
Detect modified WordPress.org plugin files while recognizing that unsupported packages require other baselines.
developer.wordpress.org - 11
WP-CLI User List
Inventory accounts and roles quickly when investigating unauthorized administrators or persistence.
developer.wordpress.org - 12
WP-CLI Cron Event List
Inspect scheduled hooks for unfamiliar persistence, reinfection, or malicious background behavior.
developer.wordpress.org