Have a hacked WordPress site? Learn how to clean up your site manually, restore from a backup, and keep it from happening again.

1. You’ve Been Hacked.
Now What?
Getting WordPress
Up and Running Again

2. Jeremy Green
@greenhornet79
endocreative.com

3. [photo of freaked out]

4. Where Do I Begin?

5. 1. Backup Hacked Site Files

6. • Site files
• Database

7. 2. Got Shared Hosting?

8. your site infected site
infection
server

9. 3. Update FTP and MySQL Passwords

11. Option #1
Restore From a Backup

12. Manual Method

13. 1. Drop infected database tables

14. 2. Import Clean Database Tables

15. 3. Delete Infected Site Files

16. 4. Upload Clean Site Files

17. 5. Enter URL and Database Settings

18. Using BackupBuddy

19. 1. Find Backup and ImportBuddy Files

20. 2. Upload Files to Your Server

21. 3. Navigate to ImportBuddy URL

22. 4. Choose Backup File

23. 5. Enter URL and Database Settings

24. 5. Enter URL and Database Settings

25. That’s great, but…

26. I don’t have a backup…
I don’t have a backup…

27. Option #2
Start From Scratch

28. 1. Download Everything Fresh

29. WordPress

30. Plugins

31. Theme

32. 2. Delete WP files on Your Server

33. 3. Upload Fresh Files

34. 4. Move Uploads Folder

35. 5. Go to yoursite.com

36. 6. Update WP Admin Passwords

37. 5. Enter URL and Database Settings

38. That’s great, but…

39. I have a custom theme/plugin/etc…

40. Check Theme Files for Backdoors
• eval()
• base64()
• <iframe>

41. Check Theme Files for Backdoors

42. Sort Files by Date Modified

43. Check for Suspicious Files

44. 5. Enter URL and Database Settings

45. That’s great, but…

46. Hire a professional.

47. Jeremy Green
@greenhornet79
endocreative.com