WooCommerce hacked but checkout has to stay up: how careful cleanup differs from a wipe

The usual advice, wipe it and restore last month's backup, sounds simple. For a WooCommerce store it often means losing real orders, customer accounts, and stock changes that happened since that backup, and it can bring the same hole right back.

This post explains how careful cleanup of a store differs from a wipe, what to do in the first hours, and when to book help. It is not a full malware-removal guide. We do not promise ranking recovery dates, Safe Browsing clear times, or zero downtime.

If you are in the first day of a hack, skim our first 24 hours after a WordPress hack guide first.

What store owners usually see

• Customers report a strange payment page, an extra form, or a redirect during checkout
• Orders, coupons, or customer accounts you do not recognize
• A new administrator or shop manager nobody created
• Spam titles in Google or phone visitors sent somewhere else
• The payment provider, host, or a security plugin warns about the site
• Nothing obvious on the storefront, but the checkout page source or plugin files changed recently

Related live guides if you recognize a sibling pattern:

• Phone visitors redirect, desktop looks normal
• Unknown WordPress administrator appeared overnight
• Spam links keep coming back after I delete them
• Plugin exploit waves: what to do the week a mass exploit hits
• Hacked WooCommerce: what not to do on a live cart

Why a wipe or blind restore is risky for a store

At a pattern level (not a claim about your specific store):

• Orders live in the database. Restoring an older copy over the live database can erase orders, refunds, customer accounts, and stock counts since that backup.
• The old backup may already be infected. If the site was reached weeks ago, the restore can put the planted code right back.
• The door stays open. A restore does not patch the plugin or theme that let the attacker in, and it does not remove a stolen password.
• Evidence disappears. Wiping first removes what shows how they got in and what they touched, which matters when you need to tell customers or your payment provider what happened. See don't wipe the host yet.

First hours: protect customers, preserve the store

1. Take a full files-plus-database copy and store it off the server before changing anything.
2. If checkout itself looks tampered with, put the store in maintenance or catalog mode, or switch to a hosted payment page your provider offers, until the checkout page is confirmed clean. A short pause is better than taking payments through a page you cannot trust.
3. Let your payment provider know if customers report strange payment forms. They can tell you what they see on their side.
4. Check your user list for administrators and shop managers nobody created.
5. Change passwords from a clean device for WordPress administrators, the hosting panel, SFTP, and the database. Turn on two-factor sign-in where you can.
6. Use the free WordPress compromise checklist to preserve evidence and decide what is safe to touch. It does not fully clean a compromised site by itself.

What careful store cleanup usually means (expectations)

• Preserve evidence first (off-server files and database)
• Work on a copy where possible, so the live store keeps running while the cause is found
• Compare WooCommerce, plugins, and the theme against legitimate copies to find added code, with extra attention to checkout, cart, and payment templates
• Remove planted files, rogue users, scheduled tasks, and database injections without rolling back real orders
• Patch or replace the component that let the attacker in
• Rotate access for WordPress, hosting, SFTP, the database, payment plugin keys, and the email behind each admin
• Plan any short checkout pause together with you, at the quietest time we can, instead of taking the store down by surprise
• Deliver a written report of what was found, removed, and rotated, and what still needs an owner step (Search Console, host panel, payment provider)
• We do not promise Google timelines, Safe Browsing clear dates, ranking recovery dates, or zero downtime

When to book

Book WordPress incident response when any of these are true:

• Customers report anything strange at checkout
• You find users, orders, files, or scheduled tasks you cannot explain
• Spam, redirects, or security warnings are already showing up
• You cannot afford to lose orders to a blind restore
• You need a written report of what was found, removed, and rotated

Published cleanup packages start around $2,500 (typical ranges and combined cleanup and hardening options are on the IR page). Work is remote nationwide; Tri-Cities and Western NC onsite is by appointment.

After cleanup, an ongoing Care plan ($149 / $249 / $399) keeps WooCommerce, plugins, and themes on a regular update schedule so the store is a harder target next time. Care does not replace cleanup while the site is still compromised.