Don't wipe the host yet: why blind restores hide the door

It usually is not. A blind wipe or restore often hides how the door got in, can put the same malware back from a dirty backup, and erases logs you needed for a board, insurer, or careful cleanup. This post explains what owners usually see, what a blind wipe or restore usually does, what not to do in the first hour, and when it makes sense to stop DIY and book cleanup. It is not a full malware-removal guide. We do not promise ranking recovery dates or Safe Browsing clear times.

If you only just noticed the problem, start with our first 24 hours after a WordPress hack guide and the free checklist. The shorter symptom stub WordPress hacked? Do not wipe the site yet covers the same panic pattern in fewer words.

What owners usually see

• Host or support ticket: wipe the account, reinstall WordPress, or restore yesterday's backup
• One-click "malware cleanup" or snapshot restore already tried, and the spam or redirect returned
• Casino or loan titles in Google while the logged-in homepage looks fine
• Spam links that keep coming back after delete
• Chrome or Search Console warning that the site may be hacked
• Unknown administrator, odd plugin, or mystery file someone wants deleted immediately
• No off-server backup from before the panic changes

Related live guides if you recognize a sibling pattern:

• Do not wipe yet (short stub)
• Casino titles in Google while the site looks fine logged in
• Spam links keep coming back after I delete them
• Chrome says this site may be hacked
• Spam links on a WordPress site
• Casino or gambling links injected
• Unknown WordPress administrator
• Redirects for mobile or logged-out visitors
• Google / malware warning stub

What a blind wipe or restore usually does

At a pattern level (not a claim about your specific site), a wipe, reinstall, or restore-from-host-backup without evidence first usually does one or more of these:

• Hides the door. The weak plugin, reused password, rogue admin, or planted dropper that let the attacker in is gone from the live trail before anyone documents it.
• Re-plants malware from a dirty backup. If last night's snapshot already contained the injector, restoring it puts the same problem back under a "clean" label.
• Loses logs and forensic copies. Access logs, modified timestamps, and planted files you needed for a written report disappear with the wipe.
• Leaves persistence elsewhere. A database option, must-use plugin, cron job, or theme include can regenerate spam after the visible files are replaced.
• Burns time on a false finish. The site looks calm for a day, then titles, redirects, or spam links return (see spam keeps coming back).

Reinstalling WordPress core alone does not remove planted content in uploads, the database, or a compromised theme. A host "malware cleanup" that deletes three files and leaves the dropper is not the same as a written incident report.

First-hour don'ts (preserve, do not fix-by-nuke)

1. Do not wipe the hosting account, rebuild from a blank theme, or restore yesterday's backup until you have a full files-plus-database copy stored off the server. Label that copy "pre-cleanup evidence."
2. Do not treat a one-click host restore or malware tool as finished cleanup. If the symptom returns, that is a reinfection clue, not proof the tool failed randomly.
3. Do not delete logs, odd users, mystery plugins, or planted files "to clean up" before someone screenshots and notes them. You are erasing the trail.
4. Capture evidence: screenshots of the host ticket, Search results, Chrome or Search Console warnings, the Users list, odd plugins, and any security plugin reports. Note times.
5. Change passwords for WordPress administrators, hosting, SFTP, and the database from a clean device, and do not reuse old ones. Do this after you have the evidence copy, not instead of it.
6. Avoid random "cleanup" plugins and forum snippets pasted into functions.php on a still-compromised site.
7. Do not request a Safe Browsing or Search Console review while the public pages are still dirty (see Chrome site may be hacked).
8. Work through the calm order of operations in our free WordPress compromise checklist. It helps you decide what is safe to touch. It does not fully clean a compromised site by itself.

When DIY should stop (checklist first, book when fire)

Start with the free checklist when you still have access and the main risk is making things worse with a wipe. Use WordPress incident response when any of these are true:

• Spam, redirects, or titles came back after a wipe, restore, or one-click host cleanup
• You cannot tell which administrator accounts are legitimate
• WooCommerce or lead forms need to stay up while cleanup happens carefully
• You need a written report of what was found and changed
• Chrome or Search Console still shows a warning after your deletes
• You are about to wipe and have no off-server evidence copy yet, and the business cannot afford another false finish

Published cleanup packages start around $2,500 (typical ranges and combined cleanup and hardening options are on the IR page). Work is remote nationwide; Tri-Cities and Western NC onsite is by appointment.

What careful cleanup usually means (expectations)

• Preserve evidence first (off-server files and database), then find what visitors and search engines can still reach that looks harmful
• Remove planted content and the persistence behind it, not just the symptom the wipe was meant to erase
• Close the original weak point where it can be identified
• Deliver a written report of what was found and changed
• Avoid "one-click host clean" or blind restore as the whole plan
• Search Console or Safe Browsing review is an owner step after the site is actually clean
• We do not promise Google timelines, Safe Browsing clear dates, or ranking recovery dates. Timing is controlled by Google's systems, not by the cleanup itself

After cleanup, hardening and ongoing Care ($149 / $249 / $399) are optional next steps so the same door is less likely to reopen. They do not replace cleanup while the public site is still compromised.