Immediate Steps
- Take site offline to prevent further damage
- Change all passwords (cPanel, FTP, database, WordPress)
- Check File Manager for recently modified files
- Restore from last clean backup
Scan for Malware
cPanel → Virus Scanner → Entire Home Directory. Quarantine all infected files.
WordPress Recovery
- Delete all plugins, reinstall from wordpress.org
- Re-upload WordPress core files
- Change database passwords and secret keys
- Install Wordfence, run full scan