How to Prevent and Recover From a Hosting Account Hack

WordPress recovery commands (via SSH or WP-CLI)

# 1. Replace WordPress core files with clean versions
wp core download --force --skip-content

# 2. Check for unknown admin users
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# 3. Delete suspicious admin accounts
wp user delete SUSPICIOUS_USER_ID --reassign=YOUR_ADMIN_ID

# 4. Reset all user passwords
wp user reset-password $(wp user list --field=ID)

# 5. Regenerate security salts (forces all sessions to expire)
wp config shuffle-salts

# 6. Reinstall all plugins from clean sources
wp plugin install $(wp plugin list --field=name) --force

# 7. Check for modified theme files
wp theme verify-checksums --all

# 8. Verify core file integrity
wp core verify-checksums

# 9. Search database for injected content
wp db search "eval(" --regex
wp db search "<script" --regex
wp db search "base64_decode" --regex

# 10. Flush all caches
wp cache flush
wp rewrite flush

SQL queries to detect and clean database injections

-- ALWAYS backup database before running cleanup queries
-- mysqldump -u user -p database > backup_before_cleanup.sql

-- Find injected scripts in posts
SELECT ID, post_title FROM wp_posts
WHERE post_content LIKE '%<script%'
   OR post_content LIKE '%eval(%'
   OR post_content LIKE '%base64_decode%'
   OR post_content LIKE '%document.write%';

-- Check for modified site URL (common hack indicator)
SELECT option_name, option_value FROM wp_options
WHERE option_name IN ('siteurl', 'home', 'blogname', 'blogdescription');

-- Find suspicious users created recently
SELECT * FROM wp_users
WHERE user_registered > DATE_SUB(NOW(), INTERVAL 30 DAY)
ORDER BY user_registered DESC;

-- Check for injected admin capabilities
SELECT * FROM wp_usermeta
WHERE meta_key = 'wp_capabilities'
  AND meta_value LIKE '%administrator%';

-- Find spam links in comments
SELECT comment_ID, comment_content FROM wp_comments
WHERE comment_content LIKE '%<a href%'
  AND comment_approved = '1';