- Take the site offline or into maintenance mode.
- Change all passwords: hosting, database, admin accounts and API keys.
- Restore clean files from a backup or a fresh download.
- Check the database for unknown admin users.
- Update everything, then bring the site back.
- Find how it happened, often an outdated plugin or reused password, and fix it.
0 comments