<b>Compromise Response SOP</b>

<b>Compromise Response SOP</b>
Follow in order the moment you suspect a hacked WordPress site.

— Step 1: Don't delete anything yet. Take a forensic snapshot of files and database first.
— Step 2: Rotate everything: all passwords, salts in <code>wp-config.php</code>, DB credentials, and API keys.
— Step 3: Force logout of every session by changing the secret keys — this invalidates active cookies.
— Step 4: Diff core files against a clean WordPress checksum. Replace, don't clean, modified core.
— Step 5: Hunt for new admin users and scheduled cron tasks the attacker planted.
— Step 6: Search uploads and theme dirs for injected PHP and base64-encoded payloads.
— Step 7: Patch the entry point before restoring access, or you reinfect.

Run this every time.