Restoring a website may bring the familiar design back quickly. It can also restore the same weakness that allowed the incident, or unwanted changes that were already present when the backup was created. Appearance alone is not a recovery test.

Establish what the backup actually contains

Ask when it was taken, which parts of the site it includes, and whether it predates the suspected incident. Website files and stored content may be backed up separately. Keep a copy of the affected state for investigation before replacing it. A recovery plan should account for legitimate changes made since the backup, such as new enquiries or updated content.

Investigate the route back in

Have the responsible specialist review the relevant software, accounts, and hosting configuration. WordPress guidance treats hardening as layered protection, including maintained software and careful access management. Avoid assuming a single plugin installation solves the issue. Credential changes and cleanup steps need coordination so that access is not re-exposed during recovery.

Define what “recovered” means

Agree on checks for the public site, administrative access, and important business workflows. Test contact routes using fictional details. Review search or browser warnings separately if they were present, and allow for external review processes. Record the likely cause, changes made, and remaining follow-up work. This gives future maintenance a useful starting point instead of leaving everyone to guess what happened.

MAKE IT ACTIONABLE

Your next steps

  • Confirm backup date and coverage.
  • Preserve an incident copy before replacement.
  • Address the entry point as part of recovery.
  • Test both website behaviour and customer journeys.

Official reference

WordPress: Hardening WordPress

Technical guidance checked September 29, 2026. Product features and requirements can change. The business checklists above are practical suggestions from Cyber Bounds.

PUT THE NEXT STEP INTO PRACTICE

Help with hacked website recovery.

Help with unwanted redirects, malware warnings, suspicious changes, and website cleanup. Tell us about your situation and we’ll discuss a suitable scope and quote.

Explore Hacked Website Recovery