My WooCommerce Site Was Hacked — What Do I Do First?
Why Speed of Containment Matters
A compromised site can be actively serving malware to visitors, skimming payment information, sending spam, or providing an attacker ongoing access to make further changes — every hour it stays live and compromised increases both the damage and the cleanup complexity. Stopping that active harm takes priority over understanding exactly what happened, which can be investigated properly once the immediate bleeding is stopped.
Immediate Steps
- Take the site offline or into maintenance mode immediately, through the hosting control panel if WordPress admin access is compromised or untrustworthy.
- Change all passwords — WordPress admin accounts, hosting/FTP/database credentials, and any connected third-party service credentials — assuming everything may be compromised until proven otherwise.
- Check for unauthorized admin accounts created by the attacker, a common persistence technique that needs removing as part of cleanup, not just password changes on existing accounts.
- Notify the payment gateway provider if there's any possibility payment data was accessed, since they have their own incident procedures and may need to take protective action on their end too.
- Preserve evidence where possible (logs, a snapshot of the compromised state) before wiping anything, since understanding the entry point matters for preventing recurrence.
Full Recovery Process
- Contain the incident first as described above, before anything else.
- Restore from a clean, pre-compromise backup if available and its integrity can be confirmed, rather than trying to manually clean an actively compromised installation.
- If no clean backup exists, a thorough malware scan and manual file/database review is needed to actually remove the compromise rather than just its visible symptoms.
- Identify and close the actual entry point (an outdated plugin, a weak password, a server vulnerability) before bringing the site back online, or the same compromise will likely recur.
- Consider legal/regulatory notification obligations if customer data was genuinely exposed, which varies by jurisdiction and needs proper advice.
Need urgent help containing and cleaning up a compromised store? See WooCommerce fixes.