Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Assume the compromise is wider than the visible defacement until you prove otherwise. First document what happened, then isolate the affected service, preserve logs and files, rotate every reachable credential from a clean device, investigate both the server and administrator computers, and recover only from a verified-clean backup or a fresh patched build. Do not simply delete a suspicious plugin and put the site back online.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
This sequence applies whether visitors see spam pages, redirects, a changed homepage, new administrator accounts, unexplained outbound mail, a hosting alert, or only a vague malware warning. A WordPress infection can be confined to one site, but a VPS breach may expose other virtual hosts, databases, scheduled jobs, SSH access, and control-panel credentials.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Start with an incident record, not a cleanup
Before deleting files, reinstalling WordPress, or changing timestamps, create a written timeline. WordPress.org identifies documentation as the first actionable step because a precise record helps you and your host distinguish an isolated file change from a persistent intrusion.
Record the symptoms and timing
- Save screenshots or copies of defaced pages, redirects, pop-ups, spam posts, unfamiliar login notices, browser warnings, and search-engine or antivirus alerts.
- Write down the first time anyone noticed the problem, including the time zone, and the last time the site was known to be normal.
- List recent plugin, theme, WordPress core, operating-system, server, DNS, firewall, and hosting-panel changes.
- Note every unfamiliar WordPress user, SSH key, cron entry, process, file, database account, mailbox, API token, or provider notification.
- Record which domains, applications, databases, and customer-facing services share the VPS or hosting account.
Keep this record separate from the compromised server. Do not trust a timestamp shown by an altered application as your only evidence; compare web, authentication, firewall, database, and provider logs.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Contain the compromise without destroying evidence
Restrict public access
If practical, put the affected site behind a maintenance response, provider-level firewall rule, private network, or temporary access list. For a VPS, isolation at the host or network layer is preferable to relying only on a WordPress maintenance plugin, because malicious code may run before WordPress loads. CISA recommends isolating affected systems during incident response.
Tell the hosting provider what you observed and when. Ask whether other accounts, virtual hosts, snapshots, IP addresses, or services show related activity. If taking the entire VPS offline would interrupt unrelated critical services, isolate the suspected instance first and obtain provider guidance before making broader changes.
Preserve volatile and durable evidence
Before cleanup, retain a read-only copy of the database, affected files, server and web logs, authentication records, firewall logs, suspicious binaries, email queues, and relevant timestamps. CISA warns that highly volatile evidence or data with short retention—such as system memory, security logs, and firewall buffers—can disappear or be tampered with.
- Ask the host to preserve hypervisor, control-panel, network-flow, and snapshot data that you cannot access yourself.
- Export logs before rotating or deleting them, and record the source, time zone, and collection time for each file.
- Hash evidence copies and store them away from the production account so later cleanup cannot silently change them.
- Do not execute unknown binaries or open suspicious attachments on the computer used to collect evidence.
Evidence preservation does not mean leaving a dangerous service exposed. Isolate first when necessary, then collect what remains through a trusted channel.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Work out whether WordPress, the VPS, or both were compromised
A changed homepage proves that content was altered; it does not prove the intrusion stopped there. Treat the scope as unknown until logs and a clean rebuild establish otherwise.
| Indicator | What it may indicate | Scope to check next |
|---|---|---|
| Unknown WordPress administrator, plugin, theme, or media file | Application-level compromise, stolen admin credentials, or an exploited extension | All WordPress users, core and extension files, database options, uploads, and admin activity |
| New SSH key, privileged account, altered sudo rules, or unfamiliar cron job | Operating-system or VPS persistence | Every user, key, scheduled task, service, process, startup script, and shell history |
| Unexpected outbound mail, traffic, CPU, or disk use | Spam, cryptocurrency mining, proxying, data theft, or a web shell | Processes, network connections, mail queues, neighboring sites, and provider abuse notices |
| Multiple domains redirecting or sharing the same malicious files | Shared account, VPS, control-panel, or deployment compromise | All virtual hosts, databases, deployment credentials, DNS, CDN, and backups |
| Only one page changed with no persistence found | Possibly a limited content edit, but not proof of a limited breach | Authentication logs, file integrity, database changes, and endpoint devices before declaring it contained |
Review WordPress activity logs and HTTP requests for logins, password resets, file uploads, plugin installation, XML-RPC or REST abuse, and requests to unusual paths. Compare core, plugin, and theme files with trusted copies of the same versions. Search for web shells, obfuscated PHP, recently modified executable files, unknown users, and cron jobs that run from writable directories. On a VPS, inspect SSH authentication, privilege escalation, system services, container or control-panel activity, and every site hosted on the machine.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rotate every credential from a clean device
Assume any secret reachable from the compromised environment may have been copied. Use a computer that has been fully updated and scanned, and do not change passwords from the infected WordPress dashboard or VPS shell.
- Change the hosting-provider account and VPS control-panel password.
- Replace SSH keys; remove unknown keys and disable password-based SSH login where your operational setup permits it. Update keys in deployment systems and automation.
- Reset SFTP and FTP credentials, and disable plain FTP if it is still enabled.
- Change every WordPress administrator password, remove unknown accounts, and invalidate active sessions.
- Rotate database-user passwords and update the application configuration only after the clean environment is ready.
- Revoke and recreate API tokens for payment, email, analytics, storage, repositories, DNS, CDN, and other integrations.
- Reset email, registrar, DNS, and CDN credentials, because control of those systems can redirect users or defeat a clean rebuild.
- Change any password reused on another service, including personal accounts that shared an administrator’s old secret.
WordPress.com specifically calls for account, WP Admin, and SFTP/SSH resets. Keep a written inventory of the replacements and their owners; otherwise an overlooked token can reintroduce the attacker after recovery.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Add multifactor authentication
Enable MFA on the host, control panel, email, WordPress administration, registrar, DNS, repository, and monitoring services. A time-based phone code is better than a password alone; a physical USB security key can provide a stronger second step when the provider, identity system, SSH configuration, or panel supports it. Register at least one recovery method and store recovery codes offline, but do not leave them in the compromised account or server.
Investigate the administrator’s computers as well as the site
WordPress.org warns that a local infection can steal FTP and /wp-admin credentials. A clean server can therefore be compromised again by an infected laptop, desktop, browser profile, password manager extension, or deployment workstation.
- Run a full malware scan on every computer and mobile device used to administer the site, not just the server.
- Update the operating system, browser, SSH client, password manager, and security software before using them for recovery.
- Review browser extensions, saved passwords, SSH-agent keys, shell history, and recent downloads for unauthorized changes.
- Revoke sessions and tokens from the identity provider, email service, code repository, and hosting panel.
- If a device shows signs of compromise, disconnect it and use a separately trusted device for password resets and incident coordination.
Use more than one appropriate scanning method for the website and server, but treat scanners as leads rather than proof of cleanliness. A scanner can miss a dormant account, altered system binary, stolen key, or malware hidden in a database.
Choose a recovery path deliberately
The right choice depends on evidence quality, downtime tolerance, operator skill, and how much of the environment may be affected. Do not choose a quick file deletion merely because it restores the homepage.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Recovery option | Best fit | Advantages | Risks and requirements |
|---|---|---|---|
| Fresh VPS rebuild | Unknown scope, suspected root access, persistent malware, or unreliable logs | Removes hidden persistence and gives you a known baseline | Requires a complete inventory, clean deployment artifacts, DNS planning, and more downtime |
| Restore a pre-incident backup | A dated backup exists from before the compromise and can be verified clean | Usually faster and preserves site data and configuration | May restore the original vulnerability or attacker persistence; every restored component needs scanning and patching |
| Clean WordPress files and database in place | Strong evidence indicates a limited application-level event and the VPS is trustworthy | Can minimize interruption | Hardest to prove complete; hidden web shells, cron jobs, keys, or altered system files may remain |
CISA recommends offline, encrypted backups, prioritizing critical services, and avoiding reinfection during recovery. If you cannot establish when the compromise began, whether backups were writable by the attacker, or whether the VPS itself was controlled, prefer a fresh rebuild or qualified incident-response assistance.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRebuild or restore safely
- Prepare a clean destination. Provision a patched VPS or isolated staging environment. Use new credentials and keys; do not clone the compromised machine as your starting image.
- Install only supported components. Obtain WordPress core, plugins, themes, operating-system packages, and server software from trusted sources. Remove abandoned, unused, or duplicate extensions.
- Restore selectively. Bring back required media and database content after scanning. Do not copy unknown executable files, modified plugins, themes, shell scripts, or configuration fragments from the compromised tree.
- Review the database. Check administrator records, options, scheduled tasks, injected posts, templates, widgets, and JavaScript for unauthorized URLs or accounts.
- Recreate access. Add only known administrators, issue fresh database and deployment credentials, and configure least privilege instead of restoring broad permissions.
- Test privately. Verify logins, publishing, forms, payments, email, backups, redirects, file permissions, and integrations on a temporary hostname or restricted IP list.
- Switch traffic carefully. Update DNS or the load balancer only after monitoring is active. Keep the old system isolated for evidence and a defined retention period rather than immediately destroying it.
If you restore a backup, verify its creation time against your incident timeline and scan it before it reaches production. A backup made after the attacker gained access is not a clean recovery point simply because the site looked normal that day.
Patch and harden every layer before reconnecting
- Update WordPress core, all plugins and themes, the operating system, web server, database, control panel, container images, and exposed services.
- Remove components that are abandoned, unnecessary, or not required for the site’s current function.
- Use separate accounts for administration, deployment, database access, and routine publishing; grant only the permissions each task needs.
- Restrict SSH by firewall or trusted network, disable unused services, require key-based authentication where feasible, and protect the control panel with MFA.
- Keep uploads non-executable where your stack allows it, protect configuration files, and enforce secure transport for administration and logins.
- Configure backups that are automatic, encrypted, offline or otherwise isolated from production credentials, and periodically test restoration.
- Enable file-integrity, authentication, web, database, and outbound-traffic monitoring with retention long enough to investigate future incidents.
Outdated plugins and themes are common entry points, according to WordPress.com. Patching closes the known route, but it does not remove a backdoor already present in a restored file or database.
Monitor the return to service and communicate responsibly
For at least the first days and weeks after recovery, watch authentication failures, new users, file changes, cron jobs, process and network activity, outbound mail, DNS changes, search-engine warnings, antivirus detections, and unexplained resource spikes. Set alerts for administrator creation, SSH-key changes, plugin installation, and integrity deviations.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Tell customers what they need to know without publishing exploitable details. If personal data, payment information, credentials, or regulated information may have been accessed, follow your incident-notification plan and obtain legal or professional advice. CISA directs organizations to follow applicable notification requirements when a breach occurs; deadlines and obligations vary by jurisdiction and data type.
Recommended Free Tools
Keep a final incident report containing the timeline, affected assets, evidence locations, credentials rotated, recovery decision, vulnerabilities fixed, notifications made, and monitoring changes. That record turns an emergency response into an actionable security improvement plan.
Know when to bring in specialists
Contact the host or a qualified incident-response professional when you see root-level indicators, cannot establish persistence was removed, suspect payment or personal-data access, lack trustworthy backups, or operate several dependent services. Ask for help with imaging, log preservation, malware analysis, clean-backup validation, and legal or regulatory coordination. Professional assistance is especially valuable when preserving evidence matters more than minimizing downtime.
Do not reconnect a VPS merely because a scanner reports “clean,” a homepage looks normal, or a password has been changed. Recovery is complete only when the scope is understood as far as practical, credentials are replaced, the environment is patched and least-privileged, monitoring is active, and the restored material has a defensible clean origin.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
