Recover a Hacked WordPress Site in Nigeria Without Reinfection
A compromised WordPress site usually announces itself through someone else. The hosting provider suspends the account, Chrome displays a security warning, or a customer calls to ask why the company website sent them to a betting site. By that point, the damage has started, and the next few hours decide how much of it becomes permanent.
Rushed restores, half-finished cleanups and database guesswork often cause more lasting harm than the intrusion itself, and a site cleaned without closing the original entry point can be reinfected within weeks.
Anyone trying to recover a hacked WordPress site in Nigeria faces the same sequence: identify and contain the compromise, regain control of every account, assess what the attacker reached, choose a recovery path, then confirm the site is clean and repair its standing with Google. Prevention is a separate subject, and our WordPress security guide for Nigerian businesses covers how to harden a site that is still clean.
What Kind of WordPress Hack Is This?
Hack or Technical Fault?
A plugin conflict, an expired SSL certificate or a hosting outage can look alarming without any attacker involved. A real compromise usually leaves evidence such as unfamiliar files, unauthorised users, injected code or outbound spam the business never sent. Telling the two apart comes first, because a fault needs fixing while a compromise needs containing.
Common Signs and Forms of WordPress Compromise
The forms below can be different stages of the same incident: stolen admin credentials may lead to a backdoor, which is then used to inject spam pages or redirect visitors. Some stages show nothing on the surface, which is why the host or a customer often notices first.
| Form of compromise | What visitors and Google may see | Main risk |
|---|---|---|
| SEO spam injection | Pharmaceutical, casino or counterfeit pages indexed under the domain, often shown only to search engines | Search visibility and brand credibility |
| Malicious redirects | Visitors sent to scam or adult sites, sometimes only from mobile or search traffic | Lost customers and browser warnings |
| Phishing pages | Fake login or payment pages hosted on the business’s own domain | Fraud against third parties and blocklisting |
| Checkout tampering | Where the attacker can alter checkout, a normal-looking page that captures card or login details or sends customers to a fake payment page | Customer financial loss and data protection exposure |
| Spam mailer | Little visible change, plus host complaints and bounced company email | Email deliverability for the whole domain |
| Backdoor or admin takeover | Unknown admin users, new plugins or no visible change at all | Repeat compromise and access to stored data |
| Defacement | Homepage replaced with a message or image | Immediate reputational damage |
The First Hours: Containment Before Cleanup
A site left online can keep serving the attacker while the investigation is still underway, and hurried cleanup at this stage tends to destroy the evidence needed later.
Preserve the Evidence Before Anything Changes
Before anyone deletes files, installs a security plugin, or updates anything, the team should store a full copy of the site’s files and database off the server. Access logs belong in the same copy, since shared hosting plans may only keep them briefly. That snapshot identifies the entry point and provides the record any data protection report will rely on.
Change Critical Credentials
The business should change passwords for WordPress administrators, the hosting control panel, SFTP, the database and email accounts on the domain straight away, using a device known to be clean. An infected laptop is one way credentials leak in the first place.
New passwords do not end existing sessions or remove a backdoor. Active sessions, application passwords, SSH keys and API keys for connected services, including the payment gateway, may need revoking separately.
When to Take the Site Offline
A site serving malware, hosting phishing pages or tampering with checkout belongs offline behind a maintenance page, and Google’s guidance on sites labelled as dangerous recommends taking a hacked site down before cleaning it.
Where the problem is limited to spam pages visitors rarely see, keeping core pages available while the cleanup is planned can be reasonable.
Telling Staff, Customers and Ad Platforms
Staff should stop logging in through the site. If the attacker reached customer records, customers may start receiving convincing payment requests by email or WhatsApp, and an early message through channels they already trust confirms which account details are genuine.
Paid advertising should be paused until the site is confirmed clean, since ad platforms can disapprove ads that point to compromised pages. If an attacker demands payment to restore the site or stay quiet, paying guarantees neither outcome, and the demand itself is evidence to preserve and report.
Access and Ownership Problems That Can Delay Recovery
A technically simple cleanup can stall for days if nobody at the business can log in to the involved accounts. Our guide to business website ownership sets out who should hold which roles before anything goes wrong.
WordPress and Hosting Access
Hosting accounts, and sometimes the only WordPress administrator login, are frequently held in a developer’s name or email address. The host may require the registered account holder or an authorised administrator to request logs, backups or reinstatement.
Domain, DNS and Search Console
A domain registered by a former vendor, or DNS managed from an account the business cannot open, blocks both a host migration and the verification Google needs. Search Console is a common blind spot. If only the original developer verified the property, the business receives none of Google’s hacked-site warnings and cannot request a review after cleanup.
Third-Party Services
Cloudflare, the payment gateway dashboard, the email provider and any SMTP service each need an owner at the business who can sign in. When a developer who held these logins has gone quiet, the steps in what to do when a website developer stops responding become part of the recovery itself.
Working With the Hosting Provider
Of all those accounts, hosting matters most in the early days, because the host holds the logs and backups and decides whether a suspended site comes back online.
Suspensions and What the Host Will Need
Hosts suspend compromised accounts to protect other customers on the same server. Reinstatement generally depends on showing that the malicious files are gone and the vulnerability is closed. Some hosts offer paid cleanup of their own, which is worth weighing against independent help.
What to Request From the Host
A useful request covers:
- Server access logs for the period in question
- Available backups and their dates
- Any malware scan results the host already holds
- Changes the host has already made to the account
The most important question is whether other accounts on the same server were affected, because the answer determines whether cleaning WordPress alone is enough.
When the Server Itself Is the Problem
If several unrelated sites on the same server are compromised around the same time, the fault sits below WordPress. Outdated server software or weak isolation between accounts on shared hosting can leave a clean installation exposed to reinfection. The durable fix is a rebuild on a properly maintained host, and our guide to choosing web hosting in Nigeria covers what to look for.
Assessing the Scope of the Breach
Recovery decisions depend on what the attacker could reach, which can be far more than the visible damage suggests.
Finding the Entry Point
Common entry points include vulnerable or outdated plugins and themes, compromised credentials, insecure hosting configurations and pirated software. Licences billed in dollars make “nulled” copies of premium themes and plugins tempting, and those copies often ship with a backdoor already installed.
The preserved snapshot can help identify the entry point by showing recently modified files, unfamiliar folders inside wp-content, scheduled tasks nobody created, and admin accounts nobody recognises.
Payment and Checkout Exposure
For WooCommerce stores using Paystack, Flutterwave or a similar gateway, the key question is where customers enter card details. A hosted or redirect checkout keeps card entry on the gateway’s page, though an attacker controlling the site can still swap in a fake payment form or a lookalike page.
API credentials stored on the site can be abused, depending on their permissions, and a changed webhook or callback URL can interfere with payment confirmation, so anyone with dashboard access should check all of them. Our guide to choosing a payment gateway for WordPress in Nigeria sets out the trade-offs between integration methods.
Email, DNS and Third-Party Accounts
A site used to send spam can get the server’s IP address and the domain itself placed on email blocklists. When company email runs on the same cPanel account, staff may see messages bouncing or landing in spam, a pattern described in cPanel email problems in Nigeria.
Attackers also tamper with DNS records and email forwarding rules, so any record nobody can explain needs investigating before anyone trusts it again. Correct SPF, DKIM and DMARC records then help rebuild sender reputation once the spam source is gone.
When a WordPress Hack Becomes an NDPA Breach
Whether a hacked website counts as a reportable data breach depends first on whether personal data was involved: customer names, emails, phone numbers, order history, account logins or form submissions stored in the database or sent through the site.
Under section 40 of the Nigeria Data Protection Act, a data controller must notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of a breach likely to risk individuals’ rights and freedoms. Where the risk to affected individuals is high, the data controller must also notify them.
The Commission’s General Application and Implementation Directive explains how to assess that risk. Our guide to responding to data breaches in Nigeria sets out what the report must contain.
Reporting the Incident
A second reporting duty sits outside data protection law. Section 21 of the Cybercrimes (Prohibition, Prevention, etc.) Act, as amended in 2024, sets a 72-hour reporting period for the cyber incidents it covers.
Reports go to the national CERT through the relevant sectoral CERT or security operations centre, so identifying the right channel should happen early in the response. Banks, telecoms operators and other regulated organisations may face additional requirements under their own sector rules.
Choosing a Recovery Path
With the scope established, the right recovery path depends on whether a clean backup exists, how deep the compromise goes and how much in-house skill is available.
| Recovery path | When it fits | What must be true first |
|---|---|---|
| Restore from a clean backup | A backup exists from before the compromise began | The backup predates the compromise, restores completely and the entry point is known and closed |
| Manual cleanup | No usable backup, and the infection is limited and understood | Someone with proven file and database skills, working from preserved evidence |
| Clean rebuild | The site is old, repeatedly reinfected, heavily altered or already due for a redesign | Content and data exported and checked, and a clean hosting environment ready |
| Professional recovery | Payment data is involved, the server is compromised or nobody is confident with the other options | Access to hosting, domain and connected accounts can be handed over |
Restoring From a Clean Backup
A clean backup is the fastest route back to a working site. The challenge is choosing the right one, because the compromise may have begun weeks before anyone noticed, and files and database need to be restored from the same point.
Backups held by the host are often stored on the same server with short retention, so they may be infected or already overwritten. Our article on website backup strategy explains why off-site copies matter for exactly this situation.
Why Manual Cleanup Is Riskier Than It Looks
Without a clean backup, the alternative is removing infected files, replacing WordPress core, cleaning the database and regenerating security keys. A wrong database change can take the site down completely. A specialist who does this routinely can finish in hours what would otherwise take days of trial and error.
When a Clean Rebuild Is the Better Investment
For some sites, cleaning costs more than it saves. A fresh installation with themes and plugins from official sources, and content imported only after checking, removes the doubt that lingers after a cleanup. Sites running abandoned or nulled components, or whose original developer is gone, gain the most from starting over.
Choosing Professional Recovery Help
Once the table points towards professional help, coordination matters as much as technical skill. A local provider may be easier to work with when the host, registrar or payment gateway is in Nigeria, and our breakdown of website maintenance plans in Nigeria shows what ongoing cover typically includes once the site is back.
Where regulatory reporting is involved, the business should confirm its obligations directly instead of assuming the technical provider is handling them.
Confirming the Site Is Clean
A malware scan that finds nothing is encouraging but proves little on its own. Automated scanners look for known patterns, and custom code left by a skilled attacker can pass them. Before calling the site clean, someone should confirm the following directly:
- Every user account is recognised, with no unexpected administrators
- No unexplained files remain in WordPress core, themes, plugins or uploads
- Scheduled tasks and database options contain nothing unfamiliar
- Login, contact forms and checkout behave normally when tested
- Server logs show no fresh suspicious requests
- Search Console reports no remaining security issues
Recovering Google Search Visibility After a WordPress Hack
Cleaning the site and recovering its search visibility are separate jobs. A site can be free of malware while Google still shows warnings, and spam pages created during the attack can stay indexed long after the files behind them are gone.
When Google flags a site manually, the problem appears in the Security Issues report or the Manual Actions report in Search Console. Once the site is clean, the owner requests a review and explains what was fixed. Issues Google detects automatically clear on the next recrawl without a review request.
Google states that malware reviews take a few days, while reviews for sites hacked with spam can take up to several weeks because they may involve manual investigation. Browser warnings can lag a few days behind an approved review.
Search performance can also take time to recover where the hack created many spam URLs or affected important pages. Spam URLs that no longer exist should return a 404 or 410 response, allowing Google to recrawl and eventually drop them from its index. The Removals tool in Search Console only hides URLs temporarily.
Rushing a review request has consequences. Under Google’s Safe Browsing Repeat Offenders Policy, a site designated a repeat offender cannot request further reviews for 30 days.
Why Recovered Sites Get Reinfected
Reinfection within weeks of a cleanup usually traces back to one of four gaps in the recovery.
Leftover Backdoors and Credentials
A single hidden file, rogue administrator or scheduled task left behind is enough to bring the malware back, which is why deleting what looks suspicious rarely ends an incident. Once recovery is complete, the team should change any login or key that was not rotated during containment, since attackers often collect more than one.
The Original Entry Point Still Open
Removing the malware without fixing the vulnerable plugin or weak password that let the attacker in leaves the door exactly where it was. Automated attacks keep probing the same weaknesses, so an unpatched entry point tends to be found again quickly.
Infected Backups Restored
A backup taken after the compromise began carries the backdoor with it. Months later, someone restores that backup to fix an unrelated problem and the infection returns. Labelling or deleting backups from the compromise window once recovery is confirmed prevents that.
Nobody Watching After Recovery
Updates lapse, monitoring was never set up, and the next warning comes from the host again. Patching, login protection and other WordPress hardening measures are covered in our guide to WordPress security in Nigeria.
A network layer such as Cloudflare can add another barrier in front of the site, while the routine checks in website maintenance for Nigerian businesses help catch problems before the host does.
Documenting the Incident
Once the site is stable, a written record should capture:
- When the compromise was discovered and when it likely began
- The systems affected and the suspected entry point
- The evidence preserved and the actions taken
- The credentials rotated and the backup used
- Conversations with the host and any notifications made
That record lets the business explain the incident to a customer, an insurer or the NDPC, and gives any future investigation a known history to start from.
Dealing With a Hacked WordPress Site Right Now?
If your site is actively compromised, or your team is not confident handling the cleanup safely, we provide hacked-site recovery and ongoing protection through our website maintenance and support service. Where a clean rebuild makes more sense, our website redesign and optimisation service covers that too.
Get in touch with us for urgent recovery help.
