WordPress Site Hacked? Restore From Backup

Finding out your WordPress site is showing spam links, redirecting visitors to malware, or that Google has flagged it as dangerous can cause immediate stress. Whether you are locked out of your admin dashboard or every file scan turns up another suspicious PHP script, panic is a normal reaction — but you need a structured recovery plan, not a rushed delete-everything spree.

If you have a clean backup from before the hack, restoring your system is often faster and significantly more reliable than hunting malware file by file. This guide walks you through recovering a hacked WordPress site using MigraSync WP Restore — from choosing the right backup point to locking down your security parameters so it does not happen again.

• Time Estimate: 30–90 minutes of active work (plus restore runtime, which runs automatically in the background).
• What You Will Need:
  • Admin access to WordPress (or FTP/hosting panel credentials if your admin panel is broken)
  • A MigraSync account with an active Essential or Pro backup plan
  • The MigraSync plugin installed on the affected site
  • Your unique Master Vault Key (generated when your backups were first initialized)
  • At least one verified cloud backup from before the infection window

First: Do This Before You Restore

Take these containment steps immediately — they limit ongoing damage and preserve file evidence if you need to reference them later.

1. Take the Site Offline

Put the site into maintenance mode or enable a temporary landing page so visitors are not exposed to live malware while you recover. If your admin dashboard is inaccessible, your hosting provider will usually offer a quick maintenance toggle within cPanel or your custom hosting console.

2. Do Not Delete Everything Yet

Avoid wiping your server directories blindly. You may need to compare infected files against a clean backup structure later, and some hosting platforms require the current install folder intact to investigate support tickets.

3. Change Compromised Passwords

If there is a chance attackers have intercepted your operational credentials, rotate them across your ecosystem immediately:

• Change your WordPress admin password (if login access still functions)
• Change your hosting control panel password
• Change your database access password (note the new value down carefully, as the restore process may reset it back to your historical backup state)
• Rotate all FTP/SFTP user profiles

4. Note When the Hack Likely Started

Pinpoint the approximate infection window by checking:

• Google Search Console → Security Issues panel
• Recent plugin or theme modifications you did not personally trigger
• Unfamiliar administrative accounts listed under Users → All Users
• Automated email alerts from your host regarding malware definitions or spam script behavior

You will need to target a backup dated prior to this timeline.

Overview: Restore vs. Manual Cleanup

Understanding the difference between rolling back your ecosystem and attempting a manual file cleanup is critical to a clean recovery:

1.Damage Containment:Immediate Actions.

Take the infected site offline using maintenance toggles and isolate credential pools by changing administrative and database passwords.

2.Initialize Rollback Engine:Wizard Configuration.

Open the WP Restore manager, select the “Restore to same URL” framework, and look back through your timeline to select a verified clean snapshot.

3.Execute Full Overwrite:Asset Deployment.

Input your Master Vault Key and trigger a full-scope restore (Database + Media + Plugins + Themes) to completely overwrite infected code blocks on the server.

4.Post-Restore Security:System Hardening.

Reinstall pristine plugins and themes from clean sidecar packages, apply core version updates, and update your file directory permissions.

When Manual Cleanup Breaks

Security plugins and manual malware removal tools work well under standard conditions — until they run into sophisticated, multi-layered injections:

Manual Approach	Why It Frequently Fails
One-click malware scan	Misses obfuscated or heavily encrypted PHP strings buried inside your uploads folder or custom child themes.
Delete suspicious files only	Malicious backdoors quickly regenerate from hidden code fragments injected directly into your database rows.
Reinstall WordPress core	Leaves compromised plugin folders, theme structures, and uploaded user files completely intact.
Edit infected posts by hand	Code injections easily hide deep inside widget arrays, system options tables, and serialized meta fields.
Host “malware removal” tools	Often cleans surface files but leaves behind complex database payloads that trigger reinfections later.

A full restore from a verified clean backup replaces your database tables and completely overwrites your media directories in a single operation — returning your site to a state you know was safe.

Step 1: Confirm You Have a Usable Backup

1. Log in to your WordPress admin dashboard (or utilize a backup admin account if your primary account is compromised).
2. Navigate to MigraSync → WP Backup.
3. Open the Recent Backup Jobs log.
4. Locate a backup entry dated before the hack symptoms first appeared.
5. Verify that the status displays as Completed with available cloud storage packages.

What Makes a Backup “Restore-Ready”

MigraSync verifies a backup as completely safe and ready for recovery when the cloud upload sequence finishes successfully and the package manifest includes your core database tables along with your media, plugin, and theme assets.

Pro Tip: If your most recent backups were taken after the security breach occurred, they likely contain malware signatures as well. Scroll back to an older, trusted restore point.

Step 2: Gather Your Master Vault Key

Because your database backups are protected using AES-256 encryption, the restore process requires the exact security key that was active when that backup package was generated.

You can locate this key in one of three places:

• WP Backup → Step 1: If the key is still actively saved within your current plugin installation.
• migrasync-recovery-sheet.html: The physical recovery file you downloaded when first configuring your vault security.
• Password Manager: Your encrypted personal security notes or credential vaults.

Without the matching key, the restore pipeline aborts before committing any database alterations — saving your site from a partial or corrupt data import.

Step 3: Open WP Restore

1. Navigate to MigraSync → WP Restore.
2. Confirm that your API credentials show a validated green status under General → Status.
3. Ensure your active subscription tier includes full WP Restore privileges (Essential or Pro).

Alternative: 1-Click Disaster Recovery

If you need to bypass the standard wizard setup during an emergency configuration:

1. Navigate directly to MigraSync → WP Backup → Recent Backup Jobs.
2. Locate your verified pre-hack backup entry.
3. Click 1-Click Restore (Disaster Recovery).
4. Confirm your data scopes, input your Master Vault Key, and launch the recovery run immediately.

Step 4: Run the Restore Wizard

If you choose to use the standard guided interface, follow these structural steps:

Step 1 / 5: Where are you restoring to?

Select Restore to same URL. Because you are performing a rollback on the exact same server space and domain layout (e.g., https://www.yoursite.com → https://www.yoursite.com), you do not need the engine to run any complex URL rewrite rules. Click Next.

Step 2 / 5: Select backup point

Choose the oldest clean backup you trust that predates the infection window.

Pro Tip: When choosing between two borderline dates, pick the older option. You might lose a few days of recent post additions, but you significantly minimize the risk of restoring embedded malware back onto your server.

Step 3 / 5: What to restore

For a complete malware rollback, enable all available scopes to ensure no infected scripts are left behind:

Asset Component	Hacked-Site Recommendation	Core Purpose
Database (Required)	Enable	Completely wipes malicious admin profiles, injected scripts, and corrupted core options.
Media Library (Uploads)	Enable	flushes out your wp-content/uploads directory entirely to remove uploaded web shells and spam images.
Plugins (Sidecar)	Enable	Places clean, uncorrupted plugin ZIP files onto your server for a safe manual configuration.
Themes (Sidecar)	Enable	Pulls fresh, clean theme packages into your directory to overwrite any edited styling code.

Click Next.

Step 4 / 5: Security Decryption

Input your alphanumeric Master Vault Key. The plugin will instantly cross-verify this key against your encrypted cloud package metadata. If the key checks out, click Next and confirm to Start Restore.

Step 5 / 5: Restore Progress

The dashboard will display live progress bars as it handles downloading, decrypting, importing SQL tables, and extracting media files. You can safely close the browser tab. The restore job runs continuously in the background. Once completed, the interface will redirect you back to your clean WordPress login screen.

Step 5: Reinstall Plugins and Themes (Sidecar)

Once the restoration routine finishes, your plugins and themes are delivered as unextracted sidecar packages rather than auto-activating on the fly. This prevents broken code configurations or database conflicts from crashing your site mid-recovery.

1. Navigate to Plugins → Add New. Install your essential plugins directly from the clean sidecar package folder on your server.
2. Only reinstall the extensions you actively use — minimizing your plugin footprint directly shrinks your site’s ongoing attack surface.
3. Navigate to Appearance → Themes and re-activate your clean theme layout from the sidecar folder.
4. Immediately run updates across every theme and plugin to ensure you are running the latest patched versions from official vendors.

Step 6: Verify the Site Is Clean

Before turning off maintenance mode and welcoming back public web traffic, run through this post-recovery checklist:

• [ ] Verify that your home page and critical sub-pages resolve normally without triggering spam redirects.
• [ ] Navigate to Users → All Users to ensure no unknown or hidden administrator accounts exist.
• [ ] Review your post content layout and inspect your page source code to ensure no hidden tracking script blocks are present.
• [ ] Check Settings → General to verify that your Site URL and WordPress Address parameters are correct.
• [ ] Run your domain through the Google Safe Browsing Transparency Report tool to check your indexing status.
• [ ] Execute an independent diagnostic scan using a tool like Wordfence or Sucuri as a second opinion.

Flushing System Permalinks

To clear out residual rewrite rules, navigate to Settings → Permalinks and click Save Changes once without changing any fields on the page.

Step 7: Secure the Site After Restore

A clean restore rolls your site back to a healthy historical snapshot, but it does not automatically patch the core vulnerability that let the attackers break in. Execute these security hardening protocols immediately:

Apply Version Updates

Bring your WordPress core, active plugins, and theme frameworks up to their latest security releases. Ensure your hosting package is configured to use an active, supported version of PHP (8.1+).

Harden Access Vectors

• Change all passwords again across your ecosystem (including hosting panels, database connections, SFTP users, and all admin profiles).
• Enforce Two-Factor Authentication (2FA) for all administrative dashboard access.
• Update your root wp-config.php file permissions to a highly restrictive read-only state (440 or 400).

Mitigate Common Vulnerabilities

Breach Vector	Mitigation Protocol
Outdated Plugin Code	Update the vulnerable plugin immediately or replace it with an actively maintained alternative.
Weak Admin Credentials	Enforce strong, unique password generation across all profiles paired with active 2FA.
Pirated or Nulled Themes	Completely delete the files; only use licensed themes obtained directly from trusted official marketplaces.
xmlrpc.php Abuse	Disable XML-RPC handling completely via your .htaccess file if your workflow does not require it.

Request a Search Engine Review

If your domain is currently flagged with a red warning screen in browser search results, log in to Google Search Console, navigate to the Security Issues dashboard, and click Request Review to confirm that you have cleaned and hardened the ecosystem.

Step 8: Resume Backups on the Clean Site

Now that your site is secure, make sure your data protection layers are active going forward:

1. Navigate to MigraSync → WP Backup.
2. Verify that your Master Vault Key is securely stored and active within your dashboard.
3. Configure your automated Auto Backup routine (daily or weekly schedules are highly recommended).
4. Download a fresh copy of your Recovery Sheet and store it in an off-site repository.

Troubleshooting Common Restore Issues

The Interface Displays an “Invalid Master Vault Key” Alert

Your security key must match the exact alphanumeric parameters that were active when that specific backup was encrypted in the cloud. Check your downloaded recovery sheets instead of generating a new key string on the fly.

The Restore Finished Successfully, But Malware Signs are Still Present

This indicates that the historical backup you selected was likely captured after the initial infection took place. Navigate back to your restore dashboard and run a recovery process using an older, trusted rollback point.

You Are Experiencing an Admin Login Loop Post-Restore

Clear your web browser’s cookie cache and attempt a fresh login run. If the issue persists, log in via FTP and check your wp-config.php file to ensure no hardcoded site URL values are causing routing loops.

Restore From Backup vs. Manual Malware Cleanup

Choosing the right recovery framework depends heavily on your existing data footprint:

Operational Factor	Restore From Backup	Manual Cleanup
Recovery Speed	Fast; typically wraps up within minutes if a clean snapshot is ready.	Slow; often takes hours or days of tedious manual file auditing.
Success Reliability	High; returns your entire file ecosystem to a known-good state.	Variable; it is incredibly easy to miss deeply hidden backdoors.
Potential Data Loss	Reverts content states back to the original backup execution timestamp.	Retains your most recent articles and data points if your database rows are clean.
Required Assets	Demands a verified pre-hack cloud backup profile.	Can be executed on an environment with no existing backup history.

What If You Do Not Have a Backup?

If you were not running MigraSync or any alternative automated cloud backup utility prior to the security breach:

1. Contact Your Hosting Provider: Many managed hosts maintain automated internal server snapshots (often tracking trailing 24–48 hour windows) that they can restore for you.
2. Execute an In-Depth Plugin Scan: Install a dedicated security utility like Wordfence or MalCare to run a comprehensive file string replacement pass.
3. Bring in Professional Assistance: If backdoors continue to regenerate across your server directories, you may need to hire an experienced WordPress security professional to clean your database rows by hand.

Once your site is recovered, immediately establish a secure cloud backup routine so you always have an emergency safety net available if an incident happens again.

What MigraSync Handles vs. Your Responsibilities

MigraSync Automates	You Still Handle
Securing your historical files in an encrypted cloud vault	Pinpointing and selecting a safe, pre-hack restore date
Running complete database rollbacks via automated SQL imports	Investigating your system logs to determine when the breach began
Overwriting and replacing your media library contents cleanly	Executing post-restore password updates across all accounts
Processing extraction queues in the background while you work	Manually installing pristine extensions from sidecar packages
Verifying your vault encryption keys prior to overwriting tables	Patching the original vulnerability that allowed the initial hack

Frequently Asked Questions

Can I restore a hacked site if I only have a backup of the database?

Yes, but doing so leaves your file directories vulnerable. While a database rollback will clear out malicious admin accounts and injected post scripts, it will not remove web shells or malicious PHP files hidden inside your theme or uploads folders. For a thorough cleanup, a full-scope restore is highly recommended.

Will running a site restoration delete my recent blog posts?

Yes. Because a restore completely replaces your current database tables with the historical snapshot, any articles published or comments received after that backup was taken will be overwritten. If you have clean text records of recent posts, copy them down manually before triggering the rollback so you can paste them back in later.

Are my cloud backups safe if an attacker gains admin access to my live site?

Yes. MigraSync stores your backup packages in a dedicated, isolated cloud storage vault completely separated from your web hosting server. Because the connection uses a Zero-Knowledge architecture and your database is encrypted locally before transit, attackers cannot delete or modify your cloud archives through a standard WordPress dashboard compromise.