Protego recovery worksheet

WordPress Incident Response Checklist

Use this during a real cleanup so visible malware, the original access path, stolen credentials, and reinfection mechanisms are handled separately.

Incident record

Site and environmentIncident ownerFirst observedCurrent containmentKnown affected URLsLast known-clean backup

1. Contain without destroying evidence

Record the first alert, affected URLs, redirects, visible symptoms, and when each one was observed.Restrict public access if active abuse is continuing, while keeping administrator access available for response.Preserve the current files, database, web logs, and hosting audit logs before cleanup.Do not restore over the only available evidence copy.

2. Find the access path and persistence

List recently changed core, plugin, theme, uploads, mu-plugins, and web-root files.Review administrator users, application passwords, FTP or SFTP accounts, and hosting-panel users.Check WordPress cron and server scheduled tasks for unfamiliar downloaders or reinfection jobs.Identify vulnerable, abandoned, nulled, or unexpected plugins and themes.

3. Remove and rebuild safely

Replace affected software from trusted vendor packages instead of editing only the visible payload.Remove unauthorized users, web shells, injected scripts, redirect rules, database spam, and unknown scheduled tasks.Patch or remove the component that allowed entry. Cleanup without closing the entry path is incomplete.Keep the compromised copy isolated until verification is complete.

4. Rotate every reachable secret

Rotate WordPress, hosting-panel, FTP or SFTP, SSH, database, CDN, DNS, and deployment credentials.Replace WordPress salts in wp-config.php to invalidate existing sessions.Revoke unknown sessions, application passwords, API tokens, and connected integrations.Reset credentials from a known-clean device if credential theft is possible.

5. Verify recovery

Scan public and authenticated administrative paths from a clean browser and device.Check Google Search Console security issues and request review only after the site is clean.Test representative pages as a normal visitor, search crawler, and mobile visitor for conditional redirects.Monitor file changes, new users, scheduled tasks, outbound traffic, and alerts for at least several days.

Closure evidence

Record what proves the site is clean and the entry path is closed.

Root cause or likely access pathFiles, accounts, and persistence removedSecrets rotatedVerification performedMonitoring owner and review date