If you've just found out your site has been hacked, make a copy of it exactly as it is, infection included, before you delete anything, and write down the time. Passwords and cleanup can wait a few hours. The copy and the time can't be recovered later.
Before cleaning, copy files, database and logs
The instinct is to log into the dashboard, delete the strange files and restore yesterday's backup. Do that and the trace of how they got in is gone, and a site put back online without knowing it gets breached again the same way.
The official WordPress guide puts documentation first (what you saw, at what time, in which time zone, what changed recently) and asks for one last full snapshot of the environment before cleanup starts, infected or not. In practice that means downloading the files over SFTP, exporting the database and saving the server's access and error logs.
Of the three, the logs are the most urgent. Italy's Polizia Postale, the police unit for cybercrime, writes that one of the first things an intruder does on a breached server is alter or delete them. And if your host only keeps them for a few days, tomorrow they may be gone. Ask your host how many days of logs it keeps and whether it has copies of its own, ideally from before the attack.
On the same page the Polizia Postale lists what it needs for a complaint: the logs of the unauthorised access with date, time, connection length and IP address, the server's time zone (and how far its clock was off, if it was), the operating system and installed software, and what the intruder did.
Meanwhile, take the site away from the public. Google's guide to hacked sites recommends a 503 response served from outside, by your host or another server, not from the infected folders. Google also says that taking the site offline while you recover it is unlikely to affect its ranking.
The time you find out starts the 72 hours
If personal data passes through the site (customers, orders, newsletter subscribers, even contact form messages), the breach must be notified to the data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it, under Article 33 of the GDPR. You can skip notification only if the breach is unlikely to result in a risk to people, and even then it goes in your internal breach register. These deadlines apply across the EU; the authorities and portals named here are the Italian ones.
What "becoming aware" means is set out in the EDPB's Guidelines 9/2022: the moment you have a reasonable degree of certainty that an incident has compromised personal data. A short investigation is allowed before that, as long as it starts as soon as the alert comes in. If you wait and the breach turns out to be real, the EDPB may treat it as a failure to notify.
So there are two times to write down. The first is the alert, whether it's an email from a customer or a message from your host. The second is the confirmation, for example when you find an administrator nobody created who could see the orders. The 72 hours run from the second; the first shows the investigation didn't sit idle. If a supplier manages the site for you, the same Article 33 requires them to tell you without undue delay once they find out.
In Italy the notification goes through the Garante's portal, and it can be sent in phases. If the risk is high, for example exposed passwords or payment data, the people affected must be told too (Article 34). Companies covered by NIS2 also owe CSIRT Italia an early warning within 24 hours and a full notification within 72, and for ACN, Italy's cybersecurity agency, that clock starts the same way, once you have objective evidence.
Passwords and access
Change the passwords for hosting, SFTP, database, WordPress admin and the domain's mailboxes, from a computer you know is clean: the WordPress guide points out that the infection often starts on the PC of whoever manages the site. Note down any administrators you don't recognise, then remove them. Regenerate the secret keys in wp-config.php to close open sessions, and the keys for external services such as payments and email sending; our article on OpenCode explains how to do it without stopping everything.
Clean up or restore the site
Restoring means going back to a copy from before the infection, and it works if you know when the infection started. If the intruder has been in for a week, yesterday's backup already contains the door they left. The logs tell you the date better than file timestamps, which can be changed. A restore also rolls back the database, so orders and sign-ups that came in after that day have to be recovered by hand from the infected copy.
And it puts back the version of the plugin they came in through. In 2025, 91% of new WordPress vulnerabilities were in plugins, and about half of the high-impact ones were exploited within 24 hours of disclosure, according to Patchstack's 2026 report. That plugin has to be updated or removed before the site reopens.
Cleaning up means keeping the site as it is and removing what was added. You reinstall the core in the same version by uploading the files over SFTP: the WordPress guide advises against the reinstall button in the dashboard, which overwrites existing files but leaves the new ones the intruder put there. wp-admin and wp-includes can be replaced entirely. In wp-content you work by hand, starting with .htaccess, index.php and the theme files header.php, footer.php and functions.php. Plugins and themes get reinstalled from official sources, and once you're done the passwords change one more time.
Either way, our rule is the same: if you haven't found how they got in, the site doesn't go back online. The most common causes are in our article on WordPress vulnerabilities.
Police report and Google's warning
Unauthorised access to a computer system is a crime in Italy. The Polizia Postale's online reporting form doesn't count as a formal complaint, and the online pre-complaint is for now only being trialled at a few offices in Lazio, including the Rieti and Frosinone police headquarters. Almost everywhere else you go in person, with the copy from the first hour.
If Google has flagged the site, the warning won't go away on its own. In Search Console the Security issues report lists the affected pages; once you've fixed them all, request a review and explain what happened and what you did. Google says it takes from a few days to a few weeks, and asks you not to send another request until the active one has an answer.
What to write down before you need it
Keep it somewhere other than the site, which will be offline that day: whom to call, where the backups are and when you last tested a restore, who holds the logins, and how many days your host keeps the logs. For Effetto, our promissory note software, we published a security.txt file that says where to report a security problem, because under the Cyber Resilience Act an actively exploited vulnerability must be reported within 24 hours of our finding out.
If your site has been breached, or you suspect it has, write to us. We start from a copy of its current state, look for the entry point and tell you what to clean and whom to notify.