Discovering that your WordPress e-commerce site has been hacked is an immediate emergency. Unlike a standard blog, a compromised online store threatens your revenue, your search engine rankings, and your customers’ sensitive payment data.
If you have a clean, recent backup of your files and your database from before the breach occurred, your fastest option is to wipe the server and restore from that backup.
However, if you don’t have a recent backup, your recovery strategy depends entirely on how deep the malware went. For a standard e-commerce store, fixing the site requires triaging three specific areas:
1. Secure the Payment Gateways & Customer Data
Before touching code, you must protect your customers. Hackers often inject malicious JavaScript into checkout pages to skim credit card numbers.
- Change all database passwords, WordPress admin passwords, and FTP/hosting credentials immediately.
- Check your payment gateway settings (like Stripe or PayPal keys) to ensure funds aren’t being redirected to a rogue account.
2. Clean the Core Files & Database
You will need to verify that your server still contains your actual product images and content files (which live in your wp-content folder), while completely replacing the core WordPress system software files that are easily targeted by exploits.
For a complete, step-by-step technical walkthrough on how to manually swap out core files and hunt down hidden malicious code injections, see our comprehensive guide: WordPress website hacked? How to fix it…!
3. Audit Your E-Commerce Plugins
E-commerce sites are prime targets because they rely heavily on a massive web of third-party plugins for shipping, checkout, inventory, and marketing. A vulnerability in just one of these plugins can open a backdoor to your entire database.
Once your site is functional, audit every single plugin. Delete anything unused, and update the rest immediately.
Related: The WordPress Backdoor Scandal: Why 30+ “Trusted” Plugins Just Turned Malicious
Can one hacked website lead to others being compromised on Shared Hosting?
Got a techy/website question? Whether it’s about UltimateWB or another website builder, web hosting, or other aspects of websites, just send in your question in the “Ask David!” form. We will email you when the answer is posted on the UltimateWB “Ask David!” section.