This document provides information and steps to take if your WordPress site has been hacked. It discusses discovering if your site has been hacked through strange site behavior or messages from your host. It then outlines recovery steps like restoring from backup, running scans, changing passwords, and starting over with a fresh install if needed. Finally, it offers prevention tips such as using strong unique passwords, keeping software updated, using security plugins, and hardening WordPress configuration. The overall goal is to recover your site, remove any lingering issues, and strengthen it against future attacks.

1. You’ve Been Hacked:
What Now?
KEANAN KOPPENHAVER
@KKOPPENHAVER
HTTP://LEVELUPWP.NET

2. Who Am I?
• Developer at doejo
• Been working primarily on WP projects for the
past 3 years
• Sites large and small

3. People on the internet are rude.

4. Part 1 | Discovery

5. Your host may tell you.

6. You may see some strange
behavior
• Published posts you didn’t write
• Menu links you didn’t create
• Images you didn’t upload

7. (Check with anyone else who
works on your site)

8. Google may tell you

9. Mysterious redirections

10. Part 2 | Recovery

11. https://codex.wordpress.org/
FAQ_My_site_was_hacked

12. Backup Now
• Some hosts will disable/take down your site
when they find out you’ve been hacked
• Peace of mind during the restore process
• Useful even if (especially if) you already have
an existing backup

13. Restore from your
backup

14. You’re un-hacked!

15. Questions?
KEANAN KOPPENHAVER
@KKOPPENHAVER
HTTP://LEVELUPWP.NET

16. No backup?

18. Run local scans
• Some server infections start with your local
environment, make sure that’s clean first

19. Start from scratch
• Difficult to identify everything, even the smallest
backdoor could let attacker back in
• Fresh (separate) install, bring all content over
via WP Export

20. Post-mortem Site Scan
• Sucuri Site Scan
• WordFence Site Scan
• Command-line diff-ing (on files that aren’t
supposed to change)

21. Change everything
• wp-admin password
• DB password
• FTP/SSH password (maybe use public keys
instead?)
• Hosting admin panel
• SECRET KEYS (to kick out logged in users)

22. define( 'AUTH_KEY', 't`DK%X:>xy|e-Z(BXb/f(Ur`8#~UzUQG-^_Cs_GHs5U-&Wb?pgn^p8(2@}IcnCa|' );
define( 'SECURE_AUTH_KEY', 'D&ovlU#|CvJ##uNq}bel+^MFtT&.b9{UvR]g%ixsXhGlRJ7q!h}XWdEC[BOKXssj' );
define( 'LOGGED_IN_KEY', 'MGKi8Br(&{H*~&0s;{k0<S(O:+f#WM+q|npJ-+P;RDKT:~jrmgj#/-,[hOBk!ry^' );
define( 'NONCE_KEY', 'FIsAsXJKL5ZlQo)iD-pt??eUbdc{_Cn<4!d~yqz))&B D?AwK%)+)F2aNwI|siOe' );
define( 'AUTH_SALT', '7T-!^i!0,w)L#JK@pc2{8XE[DenYI^BVf{L:jvF,hf}zBf883td6D;Vcy8,S)-&G' );
define( 'SECURE_AUTH_SALT', 'I6`V|mDZq21-J|ihb u^q0F }F_NUcy`l,=obGtq*p#Ybe4a31R,r=|n#=]@]c #' );
define( 'LOGGED_IN_SALT', 'w<$4c$Hmd%/*]`Oom>(hdXW|0M=X={we6;Mpvtg+V.o<$|#_}qG(GaVDEsn,~*4i' );
define( 'NONCE_SALT', 'a|#h{c5|P &xWs4IZ20c2&%4!c(/uG}W:mAvy<I44`jAbup]t=]V<`}.py(wTP%%' );

23. Part 3 | Prevention

24. Strong Passwords
• Use a password manager (1Password, LastPass)
• Don’t share passwords between services (WP,
MYSQL, FTP) or installations

25. Updates
• WP Core
• Plugins, plugins, plugins (update and clean up)
• Themes (update and clean up)

26. Get a Security Plugin
• WordFence
• Sucuri
• iThemes Security

27. Hardening WordPress
https://codex.wordpress.org/
Hardening_WordPress

28. Specific Tips
• Don’t give the WP user root access to MySQL
• Change the default table prefix
• Hide the WP version
• Change the default login URL (/wp-admin)
• Don’t use admin as your username
• Block login attempts

29. Questions?
KEANAN KOPPENHAVER
@KKOPPENHAVER
HTTP://LEVELUPWP.NET