My WordPress site was hacked. What should I do?
Take the site offline or into maintenance mode, change every credential, and preserve a copy before you clean anything. Then establish whether personal data was involved, because that starts a legal clock in every US state. Cleaning first destroys the evidence you need to answer that question.
The longer version
The instinct is to clean the site and get it back up. That order is backwards: a compromised site is also the record of what happened, and once it is cleaned nobody can establish what was accessed.
Breach notification duties turn on whether personal information was acquired. If your site held form submissions, customer accounts or order data, that question has to be answered on evidence, and the answer determines who you must notify and how quickly.
Reinfection is common because the original route in is usually still open: an outdated plugin, a reused password, or a backdoor left behind. Restoring a backup taken after the compromise restores the compromise with it.
What to do
- Take the site offline and preserve a full copy, including files and database, before changing anything.
- Rotate every credential: hosting, admin users, database, API keys and anything reused elsewhere.
- Establish what data the site held and whether it was accessible, and get advice on notification duties.
- Rebuild from a known-good state rather than cleaning in place, and identify the original route in before going back online.
- Afterwards, reduce what can be attacked: fewer plugins, no unused accounts, and no admin login exposed to the public internet.
The obligation behind this
Sources
- Security Breach Notification LawsNational Conference of State Legislatures
WebSpark describes obligations and evidences what a site does. It does not provide legal advice, and this page is not a substitute for a lawyer who knows your business.