Restore the site from a backup

A full restore needs both the files and the database, taken at the same point in time. The files are WordPress itself, the plugins, the theme and the uploads in wp-content/uploads. The database holds the content, settings and users.

Any changes made after the backup was taken are lost, including new posts, orders, form entries and users.

Find the backups

Most hosting providers make backups automatically. Log in to your hosting panel and look for a menu item for backups. Check how far back they go and whether they cover both files and databases.

If the site has a backup plugin, such as UpdraftPlus, the copies may also be in a cloud service like Google Drive or Dropbox. To restore with such a plugin, you need to be able to log in to wp-admin.

Choose a backup from before the problem started. If the site was hacked, the backup has to be from before the attack. If you don't know when the attack happened, pick one from several weeks before you noticed the first signs.

Make a copy of the site as it is now

Download the files and export the database before you restore, even if the site is broken. Then you can go back to this version if the backup turns out to be too old or wrong, and recover orders and content added after the backup was taken.

Restore in the hosting panel

Many hosting panels have a restore feature of their own:

1. Choose the date you want to go back to.
2. Restore both the files and the database for the site. If you can choose, restore only the website and not the whole account, so email and other sites on the account aren't affected.
3. Wait until the job is done, then open the site.

If you can't find such a feature, ask your hosting provider to restore the site for you.

If the site was hacked, ask your provider whether the restore deletes files that aren't in the backup. If it doesn't, files the attacker added remain on the server.

Restore manually

If you have the backup as files, for example a zip file with the files and a .sql file with the database, restore the files first and the database afterwards.

If the site was hacked, delete the old WordPress files on the server before you upload the files from the backup. Otherwise files the attacker added remain on the server.

1. Upload the files to the WordPress root folder with FTP or the file manager, overwriting the ones already there. Plugins installed after the backup was taken remain, so delete their folders in wp-content/plugins.
2. Open phpMyAdmin in your hosting panel, select the database and go to the Import tab. Choose the .sql file and start the import. If the file is larger than the phpMyAdmin upload limit, import it with wp db import over SSH, or ask your hosting provider to do it.
3. If the import stops with #1050 - Table '…' already exists, the tables already exist and the SQL file doesn't drop them. Delete the tables in phpMyAdmin and import again. The copy you made before you started still has them.
4. Check that DB_NAME, DB_USER, DB_PASSWORD and DB_HOST in wp-config.php match the database you imported into, and that $table_prefix matches the start of the table names, for example wp_.

After the restore

1. Log in to wp-admin, go to Settings → Permalinks and click "Save Changes" without changing anything.
2. Clear the cache in your cache plugin, in the hosting panel and in Cloudflare if you use it.
3. If the site stopped working after an update, don't run all the updates again at the same time. Update one plugin at a time, so you can find the plugin that causes the problem.
4. If the attacker got in through a vulnerability in a plugin or theme, the backup has the same vulnerability. Update WordPress, your plugins and your theme straight away to patch known vulnerabilities. Also change the passwords for wp-admin, the hosting panel and FTP.
5. After a break-in, also replace the eight security keys in wp-config.php, from AUTH_KEY to NONCE_SALT. Get new values from WordPress.org. This logs out every logged-in user, the attacker included.

When you're stuck

If you have no backup, or only a backup of either the files or the database, you can't roll back the whole site. Ask your hosting provider whether they have older copies than the ones in the panel. Otherwise the site has to be repaired manually, which requires access to the hosting account and experience with WordPress and MySQL.