A blank page, unwanted advertising and missing content all mean the site is not working normally, but causes differ. An update failure may need a compatible component; compromise requires trust assessment of the environment. We begin with symptoms and sources, restore agreed operations and consider WordPress replacement separately from immediate assistance.
Preserve information
Record discovery, errors and recent changes. Establish visitor and staff experience. Unknown users, redirects or file changes can indicate compromise. Limit impact and retain logs and snapshots before uncoordinated reinstalls or deletion. Otherwise evidence and the ability to identify suitable recovery copies may be lost.
Check backup contents
WordPress needs database, uploads and configuration, with separate theme and plugin versions. Content exports are not full application archives. Establish actual contents and date, then test separately. Suspected compromise affects source selection. An uncertain clean date remains a documented limitation, not something hidden behind a promise to clean everything.
| Area | What is restored | What is reconciled |
|---|---|---|
| Content | Pages and posts | Text and statuses |
| Media | Images and documents | Links and availability |
| Users | Required accounts and roles | Permissions and unknown accounts |
| Store | Products and orders | Amounts, states and recent activity |
Build a trusted environment
Use verified sources and applicable fixes instead of automatically restoring unknown extension archives. Review custom work separately because reinstalling core does not explain it. Restrict access and assess PHP and server components independently. Reinstalling a CMS over a vulnerable environment or exposed credentials does not settle the problem or investigation.
Assess passwords and keys according to possible exposure, changing them in a trusted environment after containing the cause. Include hosting, domain, email and integrations. Restored files do not provide control while unauthorised account ownership remains. The customer needs clear owners and revocation methods to prevent post-recovery tampering.
Restore content and editing
Check important materials, categories, navigation and images, particularly builder pages and custom fields. Have an editor publish and preview. Reading existing posts is insufficient if the team cannot continue working. Agree temporary omissions explicitly so staff know what is operational and what remains, rather than assuming complete readiness.
Check the store separately
Yesterday’s database can lose today’s orders. Determine the gap and reconcile payment and accounting sources. Check customer–order–payment relationships. Prevent automatic repeat email and archived operations from replaying. Restrict outbound actions in testing and verify the complete live scenario with error visibility before buyers return. Document partial recovery gaps for manual reconciliation.
- Symptoms and available evidence → Check backups and sources
- Check backups and sources → Trusted environment
- Trusted environment → Content, accounts and orders
- Content, accounts and orders → Operation confirmed?
- Operation confirmed? → Check backups and sources (No)
- Operation confirmed? → Launch and assess replacement (Yes)
If administration is unavailable
Losing dashboard access does not mean all content is lost. Review available backups, database and files through agreed administrator channels, without trusting every archive automatically. Restore ownership and configuration where relevant; suspected compromise still requires care. The goal is necessary data and control, not bypassing unexplained restrictions at any cost.
After recovery, run an editorial cycle and check a fresh backup. An employee edits a test material and confirms rights; the administrator verifies restoration separately. This exposes unfinished issues before the next working day. If WordPress retirement follows, the resulting inventory supports migration without repeating discovery.
Keep verification with the release description so the next contractor understands recovered scope, limitations and remaining reconciliation.
A complete review considers access outside the dashboard as well. Domain, hosting, email and integration accounts may retain permissions that are not visible inside WordPress. Restoring the application without addressing an unauthorised external owner can allow the same changes to recur. Establish the legitimate owners and the agreed means of withdrawing obsolete access.
Content verification should include the parts editors rely on every day. A page built from custom fields may load differently from an ordinary post, and an image library can contain documents linked from several sections. Check a representative range alongside the data inventory, so a restored homepage does not conceal missing operational material.
For an active store, describe any gap between the backup and current orders clearly. Staff need to know which operations require reconciliation and which sources support it. Do not automatically replay emails, payments or integrations from an archived state.
Finally, record the conditions for closing the emergency stage. The customer should understand remaining limitations and responsibilities, including external review processes and any separate personal data assessment.
What happens after launch?
Repeat checks on the production domain and enable agreed monitoring. Follow external systems’ review procedures for warnings; their removal is not controlled by one contractor action. Separately assess personal data consequences and notification needs. Technical recovery does not cancel that process. Provide completed work, uncertainties and continuing responsibilities so emergency closure is an informed decision.
If the old system no longer supports controlled updates and dependencies, propose Go or Node.js with replacement publishing. Preserve agreed content and workflows under a separate quote. Send the address, symptoms and backup information without secrets. We identify the first useful result and sequence, restoring control so future development can be planned without repeating dependence on the old installation.
Sources
WordPress: responding to a hacked site. WordPress: standard content export. EDPB: personal data breaches. Checked on 26 October 2026. Migration procedures, examples, prices and delivery conditions describe the project’s proposed service.
