My site is attacked, so basically all the core php files are corrupted and broken. Only the database is left.

Now I tried in my localhost.

  1. If I want to restore my site from this database, is domain name the only thing that I need to replace string?
  2. I've found this tutorial - Replace string in database - to change the domain strings in all tables, but hardly know where to put it in and how to trigger it in wordpress.
  • 3
    Hi. Your database can be corrupted too. Some scripts can detect WordPress installations and attack the database using WP credentials. Doesn't your hosting provide a backup/restore? – Jack Johansson Jun 18 '17 at 12:48
  • @JackJohansson the database is what I can try now. I'm not sure but it seems like they don't provide it so they ask me to fix it. – Yoona Jun 18 '17 at 12:55
  • 1
    If you downloaded the database from your website, then the URLs are correct. Why do you need to change them? – Jack Johansson Jun 18 '17 at 12:57
  • I'd rather try with my localhost first before changing anything. – Yoona Jun 18 '17 at 13:03
  • Well, then you can try Better Search Replace plugin to replace all localhost strings with your domain. Upload the database, change siteurl and homeurl in the cpanel, and then use the plugin (make sure you don't replace localhost with http://http://localhost/ or something). Tada. – Jack Johansson Jun 18 '17 at 13:07

I agree that the Better Search and Replace plugin is great for search/replace of the WP database.

But be aware that there are many other things you need to do to recover a hacked site. There are many places to get that info, but when I do it, I

  • change all credentials/passwords: database, FTP, hosting, admin-level users

  • reinstall WP (from the Updates screen), then reinstall all
    plugins/themes from original sources

  • Look closely at all files for modified dates that are not 'right'
    (using the hosting/FTP file manager to sort by date is helpful; most valid files will have similar dates)

  • Remove access to the xmlrpc.prg fle - that is a great attack vector

  • Check for any file names that are not expected. And check everywhere.

Details on how I recover from a hacked site are more than can be placed in an answer here. But I've detailed my procedure here, which may be helpful. It is possible to recover a hacked site, but it does take some effort. And it will take a while for the search engines to get the changes updated after you fix things.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.