adminHacked VPS or WordPress Incident Containment Checklist
When a VPS or WordPress site appears hacked, the first goal is containment. Do not rush into deleting files. Preserve evidence, stop active damage, protect data, rotate access and rebuild trust step by step.
Core principle
Incident response has phases: contain, preserve, investigate, clean, recover and monitor. Skipping containment can let the attacker keep access while you clean symptoms.
Checklist
- Record the incident time and symptoms.
- Take a snapshot or backup of the current state if safe.
- Restrict admin access while investigating.
- Change critical passwords from a clean device.
- Review unknown users and SSH keys.
- Review recent file changes.
- Check logs for suspicious access.
- Disable suspicious plugins, services or workflows carefully.
- Restore from a clean backup or clean the system methodically.
- Monitor for reinfection after recovery.
Reusable lesson
Containment logic applies to hacked WordPress, compromised VPS, leaked API keys, abused webhooks and infected automation systems.
When to Use This Checklist
Use this checklist when a VPS or WordPress website shows signs of compromise, unknown admin access, malware, redirects or suspicious services.
Required Tools
Admin access, SSH access, backup or snapshot, clean device, logs, security plugin, DNS and hosting access
Before You Start
Do not clean only visible symptoms. First contain access and preserve enough evidence to understand how the compromise happened.
Structured Checklist Steps
- Record symptoms.
- Backup current state.
- Restrict admin access.
- Rotate critical passwords.
- Review users and SSH keys.
- Review file changes.
- Check logs.
- Disable suspicious components.
- Restore or clean methodically.
- Monitor reinfection.
Verification Steps
- Unknown access is removed.
- Critical credentials are rotated.
- Suspicious files are documented.
- Site works after recovery.
- No reinfection appears during monitoring.
Rollback Plan
If cleanup breaks production, restore the latest safe backup or isolate the site on staging while keeping the compromised state for investigation.
Common Mistakes
- Deleting files before backup.
- Changing only WordPress password but not VPS or database credentials.
- Ignoring SSH keys.
- No post-cleanup monitoring.
- Restoring from a backup that is already infected.
Related Commands
date
who
last -a | head
sudo tail -n 100 /var/log/auth.log
find /var/www/example.com -type f -mtime -7
wp user list
sudo ss -tulpn