❗ First Things First: Stay Calm & Do NOT Rush

A hacked website can feel like a disaster — but it is recoverable if you act correctly. The biggest mistake people make is panicking and deleting things randomly. That often makes the damage worse.

⚠️ Rule #1: Do NOT start deleting files or reinstalling WordPress until you understand the situation.

✔️ Step 1: Take the Website Offline (If Needed)

If your site is displaying malware, scams, or explicit content, take it offline temporarily.

Option 1: Use “Maintenance Mode” Plugin

If WordPress is still accessible, activate any maintenance mode plugin.

Option 2: Rename Public Folder (Advanced)

If your site is severely compromised, rename your public_html temporarily:

public_html → public_html_offline

✔️ Taking the site offline prevents visitors from being harmed while you fix the problem.

✔️ Step 2: Change ALL Passwords Immediately

Change these passwords before doing anything else:

• cPanel / DirectAdmin
• WordPress admin
• Database user
• Email accounts
• FTP / SSH

⚠️ If you do not change passwords, the attacker may still have access and undo your fixes.

✔️ Step 3: Scan and Identify the Problem

Use both external and internal scanners.

External Scan Tools

• Sucuri SiteCheck
• VirusTotal URL Scan

Internal Scan Tools

• Wordfence (WordPress)
• MalCare
• iThemes Security

✔️ A scan will tell you WHERE the malware is and what kind it is, which helps you choose the best restore method.

✔️ Step 4: Decide Whether to CLEAN or RESTORE

There are two ways to recover:

Option A: Clean the Infection

Use Wordfence or a security service to scan and remove malware.

Good if:

• Your site changes frequently
• No reliable backups are available
• You want to keep recent content

Option B: Restore a Backup

Best solution for “complete and safe recovery”

Good if:

• Backup exists from before the hack
• You want fastest guaranteed fix
• You don’t want to edit code manually

✔️ If you have a clean backup, restoring it is usually faster and safer than manually deleting malware.

⚙️ Step 5: Restore Using JetBackup in cPanel (If Available)

This is the easiest restore method on Nairahost.

1. Login to cPanel
2. Open JetBackup
3. Select the backup version BEFORE the hack happened
4. Click Restore
5. Wait for completion

✔️ JetBackup can restore only files, database, or full account depending on your needs.

⚙️ Step 6: Manual Restore (If No Automated Backup Exists)

Restore Files

1. Upload a clean ZIP of your site
2. Extract into public_html
3. Replace infected files

Restore Database

1. Open phpMyAdmin
2. Select existing database
3. Click Import
4. Select SQL file from backup

✔️ Step 7: Reset Critical Files (Especially for WordPress)

Even after restoring, replace:

• wp-admin folder
• wp-includes folder
• index.php core file

Use a fresh download of WordPress from wordpress.org.

❗ Step 8: Remove Backdoors

Hackers often leave hidden files (backdoors) so they can re-enter later. These are usually disguised as:

• Randomly named PHP files
• Files inside /uploads that should not be PHP
• Modified config files
• Base64 or eval encoded code

⚠️ If you restore your site without removing backdoors, the hacker will return — even if you change passwords.

✔️ Step 9: Clear Cache and CDN

After restoring, clear:

• WordPress cache plugin (LiteSpeed, WP Rocket, etc.)
• Cloudflare cache (if used)
• Browser cache

✔️ Step 10: Enable Full Security Protection

Once your site is clean and restored, protect it immediately:

• Install Wordfence or iThemes Security
• Enable 2FA on WordPress & cPanel
• Replace weak passwords
• Install SSL & force HTTPS
• Remove unused plugins/themes
• Enable backups
• Use custom login URL

⚙️ What Nairahost Provides for Recovery

• JetBackup support for instant restores
• Malware scanning on request
• Secure account isolation
• Server firewall protection
• Safe nameservers:

  cPanel: ns1.nairahost.cloud / ns2.nairahost.cloud
  DirectAdmin: ns1.nairahost.com.ng / ns2.nairahost.com.ng

✔️ Final Incident Recovery Checklist

• ✔️ Passwords changed everywhere
• ✔️ Backup restored or site cleaned
• ✔️ All malware and backdoors removed
• ✔️ Security plugin installed
• ✔️ SSL forced
• ✔️ Google Search Console checked
• ✔️ Remote backups enabled