How to Recover a Hacked WordPress Site (Step by Step)
Signs your WordPress site is hacked and a step-by-step recovery plan: contain, change credentials, restore or clean, remove backdoors, update, request…

WordPress errors look scary, but most have simple causes: a conflicting plugin, a theme bug, a memory limit or a configuration mistake. With a calm, methodical approach and a recent backup, you can fix most of them yourself.
Key takeaways
- Take a backup before troubleshooting.
- Enable debug logging to see the real error.
- Deactivate plugins and switch to a default theme to find conflicts.
- Check hosting resources and PHP version.
Back up files and the database, note what changed recently (updates, new plugins, code edits) and enable debugging in wp-config.php:
define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true);
define('WP_DEBUG_DISPLAY', false);Errors will be written to wp-content/debug.log.
Usually a fatal PHP error from a plugin or theme. Rename the plugins folder via FTP or file manager to deactivate all plugins; if the site returns, reactivate them one by one. If not, switch to a default theme. Increasing the PHP memory limit can also help.
Check for a corrupted .htaccess file (rename it and regenerate by saving permalinks), plugin conflicts, PHP memory limits and server error logs in your hosting panel.
Verify database name, user, password and host in wp-config.php, check whether the database server is down with your host and repair the database if tables are corrupted.
Go to Settings > Permalinks and click Save to regenerate rewrite rules. Check .htaccess permissions.
Increase the memory limit in wp-config.php (for example define('WP_MEMORY_LIMIT', '256M');) or ask your host, then find the plugin using excessive memory.
Delete the .maintenance file in the site root after a failed update, then rerun the update.
Clear cookies and cache, check site URL settings, disable plugins and regenerate .htaccess.
Check file permissions, available disk space and PHP version, and try updating manually.
If errors persist, the site shows signs of hacking or it's a busy store losing sales, get professional help quickly.
| Error | Most common cause | First thing to try |
|---|---|---|
| White screen | Plugin or theme fatal error | Rename plugins folder |
| 500 error | .htaccess or PHP error | Rename .htaccess, check logs |
| Database connection | Wrong credentials or DB down | Check wp-config.php and host status |
| 404 on posts | Rewrite rules | Re-save permalinks |
| Memory exhausted | Heavy plugin or low limit | Raise memory limit |
| Too many redirects | SSL/URL mismatch | Check site URL and CDN SSL mode |
| Upload failed | Permissions or size limit | Check folder permissions and upload limits |
Test updates on staging, keep a backup before changes, use reputable plugins, keep PHP current and monitor uptime so you know about problems before customers do.
When a fatal error occurs, WordPress emails the admin a recovery-mode link. Use it to log in safely, deactivate the faulty plugin or theme, and then investigate the cause.
Note every incident, its cause and fix. Patterns, such as repeated problems after a specific plugin's updates, help you choose more reliable tools.
Use your hosting file manager, FTP/SFTP or SSH to edit files and deactivate plugins.
Yes, through conflicts or compatibility issues. Test updates on staging and keep backups.
A currently supported version compatible with your theme and plugins.
Troubleshooting usually doesn't touch content, but always have a backup first.
A fatal PHP error, usually from a plugin or theme. Check the recovery-mode email WordPress sends to the admin and the debug log.
Use a staging site, update one component at a time, keep backups and choose actively maintained plugins.

Signs your WordPress site is hacked and a step-by-step recovery plan: contain, change credentials, restore or clean, remove backdoors, update, request…

WordPress backup best practices: what to back up, the 3-2-1 rule, frequency, plugin and hosting backups, off-site storage, testing restores and a reco…

Essential WordPress security steps: updates, strong logins and 2FA, trusted plugins and themes, security plugins and firewall, file permissions, backu…
Sakr Web builds and grows websites, stores and apps: design, speed, security, SEO and ads.
Website, store, app, SEO or marketing: a free plan and quote within 24 hours.