Describe the observation precisely enough to investigate
Start with what you can actually establish: which address changed, which user appeared, what the provider reported or which visitor saw a redirect. Include the time and timezone, browsing context and any recent authorized work. WordPress's hacked-site FAQ emphasizes describing symptoms and documenting the sequence. That is a more useful starting point than a general statement that the whole site was hacked.
Record the business effect separately. A checkout failure, an inaccessible dashboard and a changed search result may require different immediate decisions. Keep screenshots or original notices through the approved evidence process without exposing passwords or customer details. Do not repeatedly open suspicious destinations or install extra tools on the live site solely to produce a more dramatic demonstration of the symptom.
Pair each sign with a question and an alternative explanation
A sign is a reason to investigate, not a complete diagnosis. Ask who could authorize the change and whether a known deployment or provider action explains it. The alternative explanation is not an excuse to ignore the sign; it identifies what evidence would distinguish an operational change from unwanted activity. Keep the review open if the owner cannot establish that context.
Our symptom card helps a business give its administrator a concrete task. It is not a scanner or a self-certification checklist. Several signs may belong to the same incident, while one alarming symptom may have an ordinary cause. Avoid counting signs as though a particular total proves compromise or determines the severity without considering the affected asset and observed behavior.
| Observed sign | Question to resolve | Alternative to check |
|---|---|---|
| New administrator | Who created it, when and with what authorization? | Documented supplier or owner work. |
| Changed executable file | Does its origin and behavior match the trusted release? | An authorized update or customization. |
| Unexpected redirect | Where and under which request conditions is it generated? | An intended redirect, cache or integration change. |
| Host or browser alert | What exact finding and coverage does the notice describe? | A provider restriction or separate configuration issue. |
| Unexplained outgoing mail | Which application or credential sent it? | A misconfigured legitimate workflow or impersonated sender. |
| Injected search pages | What does the live URL and Search Console evidence show? | An old indexed state or unrelated lookalike domain. |
Check account and change ownership without erasing the sequence
Review unexpected administrative access with the person who owns the installation and the supplier work history. Compare the relevant users, roles and authorized deployment records. Do not remove every unfamiliar account before identifying whether it supports legitimate operations. If an active unauthorized route requires immediate restriction, let the incident owner authorize it and record the action and time.
File changes need similar context. A timestamp can narrow a review but does not prove who made the change or whether its content is malicious. A trusted package comparison and the actual deployment history may answer different questions. Keep custom code and business configuration in scope when planning remediation so a broad replacement does not silently remove necessary functions or carry unwanted changes into a rebuild.
Understand what a clean view or a security tool can miss
A normal-looking home page does not establish that every route behaves normally. Google documents hacked redirects and injected content that may appear differently depending on browsing context. Do not try to validate every condition by sending customers to the affected page. Use an authorized review and the available provider or Search Console evidence to establish what was observed and what remains untested.
A tool's result also needs its target and coverage. A public scan, file scan and account review do not inspect the same things. Ask which locations and time periods were covered and whether the reported finding was validated. A clean result can be useful evidence inside that scope, but it does not cancel a provider alert or a reproducible unauthorized change without an explanation.
Choose the next action according to evidence and impact
If the evidence shows an active harmful change or the host has contained the installation, move to the incident first-steps process and coordinate with the responsible provider. If the sign remains ambiguous, define a focused review instead of applying random hardening settings. Name the affected service, the question to answer and who can authorize any change that might interrupt business operations.
Keep possible information exposure separate from page cleanup. A new account or malicious script does not automatically establish which records were accessed; missing logs may prevent a definitive answer. Explain that uncertainty to the incident owner. Ask for specialist support where the required evidence or expertise exceeds the agreed technical scope, and avoid publishing unsupported attribution or affected-customer counts.
Request a handoff that explains the finding and remaining work
The outcome should say what was reviewed, which signs were confirmed or explained, what was contained and what follow-up is still needed. A report that only lists removed files does not explain the original entry or remaining access. Link each proposed action to a named owner and a verification step, including the business functions that need to keep working after remediation.
CyberFixCrew is an Israeli cybersecurity company serving worldwide businesses with practical Israeli website and digital-infrastructure knowledge. Our published services support scoped WordPress security and recovery work. Describe the specific sign and business impact first; do not submit access details or suspicious executable files through the general form. Response scope, evidence exchange and provider dependencies should be agreed before work begins.
