---
title: Incident response
canonical: https://wpsecurityninja.com/dictionary/incident-response/
---
# Incident response

Incident response is the structured process of detecting, containing, cleaning, and learning from a security incident.

[Full guide](https://wpsecurityninja.com/what-should-you-do-if-your-wordpress-site-is-hacked/)

## Why it matters for WordPress

When a site is hacked, random clicking makes things worse. A simple response order protects visitors, preserves evidence, removes persistence, and closes the door. You do not need a Fortune 500 playbook. You need a one-page checklist you will actually follow.

## How it shows up in practice

- Safe Browsing warnings, spam redirects, or a host suspension
- Unknown admins, odd plugins, or PHP in uploads
- The urge to “just restore a backup” without finding how they got in
- Cleanup that works for a day, then the malware returns

## What to do

1. Contain harm (maintenance mode, host help) and take a forensic backup.
2. Regain clean admin access; reset passwords and sessions.
3. Remove malware and backdoors; compare core to clean copies.
4. Close the entry path (vulnerable plugin, weak admin, nulled zip).
5. Harden, monitor, and write down what you will do differently next time.

Full walkthrough: [WordPress site hacked? Steps to recover](https://wpsecurityninja.com/what-should-you-do-if-your-wordpress-site-is-hacked/).