---
title: Incident response
canonical: https://wpsecurityninja.com/dictionary/incident-response/
---
# Incident response

Incident response is the structured process of detecting, containing, cleaning, and learning from a security incident.

Last updated: 2026-08-26

Also called: IR, security incident response, breach response

## Related terms

- [Assume breach](https://wpsecurityninja.com/dictionary/assume-breach/): Assume breach means designing as if an attacker may already have a foothold, so detection and recovery matter as much as prevention.
- [Event logging](https://wpsecurityninja.com/dictionary/event-logging/): Event logging records security-relevant actions so you can see what changed and when.
- [Malware](https://wpsecurityninja.com/dictionary/malware/): Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- [Backdoor](https://wpsecurityninja.com/dictionary/backdoor/): A backdoor is hidden access an attacker leaves so they can return without the original vulnerability.
- [Account takeover](https://wpsecurityninja.com/dictionary/account-takeover/): Account takeover is when an attacker gains control of a legitimate user account and can act as that user.

[Full guide](https://wpsecurityninja.com/what-should-you-do-if-your-wordpress-site-is-hacked/)

## Why it matters for WordPress

When a site is hacked, random clicking makes things worse. A simple response order protects visitors, preserves evidence, removes persistence, and closes the door. You do not need a Fortune 500 playbook. You need a one-page checklist you will actually follow.

## How it shows up in practice

- Safe Browsing warnings, spam redirects, or a host suspension
- Unknown admins, odd plugins, or PHP in uploads
- The urge to “just restore a backup” without finding how they got in
- Cleanup that works for a day, then the malware returns

## What to do

1. Contain harm (maintenance mode, host help) and take a forensic backup.
2. Regain clean admin access; reset passwords and sessions.
3. Remove malware and backdoors; compare core to clean copies.
4. Close the entry path (vulnerable plugin, weak admin, nulled zip).
5. Harden, monitor, and write down what you will do differently next time.

Full walkthrough: [WordPress site hacked? Steps to recover](https://wpsecurityninja.com/what-should-you-do-if-your-wordpress-site-is-hacked/).