Data ransom — ransomware — is not just a screen that locks a computer. On a website it can mean the database encrypted, the backups disabled, access sold or extortion with a double threat: pay to recover and pay so that what was taken isn’t published.

In WordPress it almost never enters through an unknown core flaw. It enters through a door that was already open: a plugin without updates, a reused password, an old FTP, a user nobody reviewed or a copy accessible from outside.

This guide explains what it is, where it enters, what to do in the first hours and what cannot be promised. It is not a forensic manual or a negotiation: it is the right order for not making the situation worse.

01Quick Summary

  • What it isData encryption and extortion. It can include information theft and a publication threat: double extortion.
  • Where it entersPlugins and themes without updates, weak or reused credentials, old FTP/hosting, forgotten users and the supply chain.
  • First hoursContain, copy the state, don’t delete, rotate access and restore from a clean, verified copy.
  • PreventionUpdate, least privilege, two-factor, backups off the server and restore tests.
  • LimitsPaying doesn’t guarantee recovery. Forensic analysis and filing a report are separate jobs.
  • PriorityContain first and preserve the evidence; then clean and restore. Never the other way around.

02What Ransomware Is Today

Ransomware encrypts files and asks for a payment to return access. On a website, the target can be the database, the files in uploads, the backups or the entire hosting environment.

The current version adds a second layer: before encrypting, they take data. If you don’t pay, they threaten to publish it or sell it. That is why “I have a copy” doesn’t always close the incident: you have to know what information left and what obligations exist.

The attack is also not a virus you remove with a plugin. It is an incident with access, data and legal decisions. Recovery is planned before it happens; during the incident, it is executed.

The ransom is not a recovery strategy

Paying doesn’t guarantee that they decrypt, that they won’t break in again or that they won’t publish. Real recovery starts with a clean copy, closed access and an identified root cause.

03Where It Enters in WordPress

The surface is known. None of these doors is exotic; precisely for that reason they are what gets checked:

  • Outdated plugins and themes. A public vulnerability turns into automated scanning the same day. Two versions behind is already exposure.
  • Weak or reused passwords. Credential stuffing tries combinations leaked from other services. If you used the same password, it is already on a list.
  • Forgotten users and excessive permissions. The former employee with administrator, the test account nobody deleted, a role with capabilities that don’t belong to it.
  • FTP, SSH or the hosting panel. Old credentials reused between sites, shared access and servers without isolation.
  • XML-RPC and exposed login. Amplified brute force and pingbacks used for spam. These can be restricted if the site doesn’t depend on them.
  • Supply chain. Premium themes from unverified sources, “nulled” plugins and extensions that change hands without review.
  • Phishing and email. One credential handed over in a fake email opens the door without exploiting anything.
  • Accessible copies. A backup on the same server, with a guessable URL or without protection, is part of the loot.

Most incidents don’t need a sophisticated attack. They need a door that had been open for months.

04Warning Signs and What to Do

The signs can be obvious or silent. The table guides the first look; it doesn’t replace a diagnosis.

Warning signs and first check
Warning sign What it may indicate First check
Files with rare or unreadable extensions Encryption of uploads, themes or backups Don’t delete; copy the state and check the modification date
Ransom note or message on the front page Active extortion Preserve the message and the logs; don’t negotiate from panic
The site goes down or redirects Code that hijacks the flow or saturates the server Review recent changes, .htaccess and plugins
Backups deleted or altered The attacker reached the copies first Verify external copies and their actual date
New users or emails Persistent access or impersonation Rotate credentials and review roles one by one
Odd billing or traffic Server used to mine, send spam or run proxies Review processes, logs and hosting consumption

The five steps, in order

  1. 01

    Contain

    Change passwords, starting with hosting and administration. Revoke sessions, disable suspicious users without deleting them and, if the risk is active, take the website offline.

  2. 02

    Copy and preserve

    Save the state as it is before touching anything. That copy is evidence and the recovery point. Deleting first destroys the diagnosis.

  3. 03

    Restore clean

    Go back to a verified earlier copy, update, clean and rotate every credential. Restoring without closing the door is starting over.

  4. 04

    Diagnose

    Find out how they entered and what they took. Without a root cause, the next intrusion is only waiting its turn.

  5. 05

    Notify and decide

    If personal data is involved, assess legal obligations and filing a report with counsel. Forensic analysis, if it is needed, is a separate job with chain of custody.

The WordPress security for incidents service covers containment, cleanup, lockdown and a report. It does not include forensic analysis or legal counsel.

05Prevention and Limits

  • Update with criterion. Core, theme and plugins up to date, with a copy and a test. Not updating is also a decision with a cost.
  • Least privilege. Each person with the role they need; orphaned accounts out; administrators reviewed.
  • Two-factor and unique passwords. In administration, hosting and email. Reuse turns someone else’s leak into your incident.
  • Backups off the server. Immutable copies or at least isolated ones, with tested restoration. A copy that isn’t tested isn’t a copy.
  • Minimal surface. Plugins that get used, themes that get maintained, XML-RPC restricted if it isn’t needed, protected login.
  • Monitoring. Alerts for changes, access and errors. Detecting in hours is not the same as discovering it through a client.

Prevention lowers risk; it doesn’t guarantee immunity. No connected website is invulnerable, and whoever promises “zero incidents forever” sells a phrase.

The honest limit: if the data is already encrypted and there is no copy, recovery is not guaranteed. You can try, document and contain, but not promise a result that depends on third parties and on the state of the encryption.

06Frequently Asked Questions

If I pay, do I recover the data?

Nothing is guaranteed. Paying doesn’t ensure that they decrypt, that they won’t break in again or that they won’t publish what was stolen. Recovery rests on clean copies and closed access, not on the ransom.

Does a security plugin prevent it?

It is a layer, not a guarantee. It filters, blocks and alerts, but it doesn’t compensate for plugins without updates, reused passwords or accessible backups.

Can I recover without a backup?

Sometimes recovery tools can be used, but nothing is promised. It depends on the encryption, the time and the state of the files. If legal action follows, forensic analysis is another job.

What do I do first?

Contain, copy the state and don’t delete. Then rotate access and restore from a clean copy. Cleaning without diagnosis only delays the next entry.

Is it a crime? Should I report it?

It is criminal activity. Reporting and the notification obligations depend on the country and on the data affected; they are assessed with legal counsel. This service does not replace that counsel.

How long does recovery take?

No timeline is promised before seeing the scope, the copies and the access. Containment and diagnosis come first; recovery is estimated afterward.