What to do in Order to Mitigate, Restore and Monitor a WordPress Site Under Phishing or Hacked?

Mitigating the Site

Step #1: Make sure you always use a clean and protected computer to login to the server (malicious cookies, keylodgers, spayware and viruses can snick to the server and feed vital information to the attacker )

Step #2: Backup the database

Step #3: Regular cleaning and optimizing wordpress database, use cpanel or install WP-Optimize By David Anderson, Ruhani Rabin, Team Updraft

Step #4: Change the password to stronger passwords both for database, cpanel and CMS

Step #5: Update all plugins and theme and deleted unwanted ones or the scripts with no updated over six months

Step #6: Secure and prevent editing of php script, web directories and important files like htaccess and wp-config.php files

Step #7: Change login URLs, administrator usernames, database names and usernames to access database plus changing the table prefix to the harder ones

Restoring the site

Step #8: Deleted manually all foreign folders, files suspected for phishing, any useless scripts plus old site backups as those may create loophole to attack the website

Step #9: Remove wp-admin and wp-includes core folders and related wordpress core files in root folder except wp-config.php and htaccess

Step #10: Upload fresh and current copy of the deleted wordpress folder and files wp-admin and wp-includes core folders and wp-config.php and htaccess

Monitoring the Site

Step #11: Install security monitoring and notification systems for file change within your server – recommended plugin for this is Wordfence Security – Firewall & Malware Scan by wordfence, there are other very effective script for wordpress to use. Google Search console (formerly known as Webmaster Tools) is another wonderful tool for security and Google blacklist removal

Step #12: Make sure your website is visited and scanned regularly for malware (at least once per week) using https://sitecheck.sucuri.net and other effective systems like sucuri