A critical flaw in a language like PHP means attackers scan the internet for unpatched servers. If your store was behind on updates, check it.
Signs to look for
- New administrator users you did not create
- Unknown PHP files, especially in uploads or theme folders
- Core files with recent changes
- Redirects to unrelated sites, or pages and links you did not publish
- Spam emails sent from your domain
- A sudden spike in traffic or server load
- Browser or Google security warnings
What to do
- Contain: switch on maintenance mode and tell your host.
- Preserve: copy the current files and logs for investigation.
- Restore: bring back a clean backup from before the problem.
- Patch: update PHP, WordPress, plugins and themes.
- Rotate secrets: every admin password, the database password, WordPress security keys, and payment and API keys.
- Scan: run a malware scan and review users and scheduled tasks.
- Report: tell your payment provider if customer or card data could be involved.
WordPress.org also maintains a “my site was hacked” guide with more detail.
Get a second pair of eyes
If you are unsure, ask a security-minded developer to review. NNT Mart can audit your store and, if it makes sense, move you to a platform with fewer moving parts.
Why a language-level flaw is different
Most store hacks begin with a weak password or a vulnerable plugin. A flaw in PHP itself is different, because it sits underneath everything. Attackers do not need to find your specific plugin or guess your login. They can scan large numbers of servers for the unpatched version and try the same trick on each one. That is why the days after a critical release are risky even for careful owners: the attack is automated, cheap and wide.
Krebs on Security reported that working exploits for the October 2026 PHP flaws were already being used against live sites (Krebs on Security). If your store ran an unpatched version around that time, it is sensible to check for a break-in rather than assume you are fine.
The difference between a scare and a real compromise
Not every odd behaviour means you were hacked. A slow page can be a busy server. A missing image can be a broken plugin. The signs that deserve serious attention are the ones that show someone else changed your site or your accounts:
- an administrator account you did not create, or an existing admin whose email changed
- files in your upload or theme folders with strange names or recent modification dates
- pages, links or products you never added, often selling unrelated goods
- visitors, especially from search engines or mobile, being redirected to other sites
- your domain sending spam, or customers receiving emails you did not send
- unexplained spikes in traffic, CPU use or outgoing mail
- warnings from Google, your browser or your host about malware or phishing
If you see two or more of these, treat it as a real incident.
How to check, step by step
Check your users. In the WordPress admin open Users and sort by role. Every administrator should be a person you recognise. Remove or reset anything unfamiliar and check which accounts changed recently.
Check recently changed files. Ask your host for a file manager or terminal view sorted by modification date. Look for PHP files changed since the date the flaw became public, especially in the uploads folder, where PHP files should rarely exist.
Compare WordPress core. Reinstalling WordPress core files from a clean download overwrites any tampering in them without touching your content. Many security plugins can verify core file integrity for you.
Search for injected code. Malware often hides as long, unreadable strings, base64 functions or code that runs only for visitors from search engines. A reputable scanner finds most of it.
Look at scheduled tasks and hidden admin tools. Attackers like to leave a backdoor that can bring them back after you clean up. Review scheduled tasks, must-use plugins and any plugin you do not recognise.
Check your search appearance. Search your own domain on Google. Strange titles or snippets in other languages are a classic sign of injected pages.
If you find something: the recovery plan
- Contain. Switch on maintenance mode or put the store behind a simple holding page so customers are not exposed while you work.
- Preserve evidence. Copy the current files, database and server logs before changing them. You may need them to understand how the attacker got in.
- Tell your host. They may see traffic you cannot and can help isolate the server.
- Restore from a clean backup. Choose a backup made before the first sign of trouble. If you are unsure of the date, go further back and re-enter recent orders from your payment records.
- Update everything. Move to a supported, patched PHP version, then update WordPress, the theme and every plugin. An unpatched server will simply be re-infected.
- Rotate every secret. Change all admin passwords, the hosting and FTP or SSH passwords, the database password, the WordPress security keys and any API keys for payment gateways, couriers and email services.
- Remove what you do not need. Delete unused plugins, themes and user accounts.
- Scan again. Run a malware scan and review file changes a second time after cleanup.
- Monitor closely for two weeks. Backdoors are often discovered only when the attacker returns.
Customer data and your legal duties
If the attacker could have reached customer information, you may have obligations. Contact your payment gateway and ask what they require. Check the data protection rules of the countries where your customers live, because many require you to notify customers or authorities within a short period when personal data is exposed. Keep a written record of what happened, what you found and what you changed. Being open and quick builds more trust than silence.
Never store card numbers on your own server. If your payment flow takes customers to a hosted gateway page, the most sensitive data was never on your site, which limits the damage. If you do not know how your store handles cards, ask your developer to explain it in plain words.
How to prevent a repeat
- Keep PHP, WordPress and plugins updated on a regular schedule, not only during emergencies.
- Install fewer plugins and prefer ones that are actively maintained.
- Use unique strong passwords and two-step login for every admin account.
- Give staff the lowest permissions that let them do their job.
- Keep backups off the server and test a restore at least once a quarter.
- Add a web application firewall as an extra layer, not as a substitute for patching.
- Make one person responsible for security, and write down who that is.
When it is time to rebuild
A cleaned site that depends on the same ageing plugins and an unmaintained theme will keep being a target. If you have been hacked more than once, if updates routinely break the store, or if nobody can tell you what is installed, rebuilding on a well-maintained platform is often cheaper than repeated clean-ups. A purpose-built store has fewer third-party parts, a single place to patch and a team accountable for monitoring.
Get a second pair of eyes
If you are unsure whether your store was compromised, NNT Mart can audit it. We check users, files, scheduled tasks and search appearance, explain what we find in plain language and recommend either a clean-up or a migration to a safer platform, with an Android and iOS app on the same back end if you need one. Message us on WhatsApp or use the contact form and we reply within minutes.
A realistic timeline of a break-in
Understanding how an attack unfolds helps you see why speed matters. First, automated scanners probe servers for the weakness. When one is found, the attacker places a small hidden file, often called a web shell, that lets them run commands later. Next they explore: reading configuration files for database passwords, creating a quiet administrator account and checking what the site holds. Then they monetise: injecting spam pages for search traffic, redirecting visitors to scams, stealing customer data or using your server to send spam. Days or weeks may pass between the first step and the first visible symptom, which is why checking now is better than waiting for something to look wrong.
Questions to ask yourself during a review
- Has anyone on my team seen a login screen they did not expect?
- Did we install or update any plugin from an unofficial source recently?
- Have we received complaints from customers about emails or popups?
- Are there orders with odd addresses or payment patterns that we cannot explain?
- When was the last time we reviewed users, scheduled tasks and file changes?
If the honest answer to most is “we do not know”, the answer itself shows the need for monitoring.
What good monitoring looks like
Good monitoring is not complicated. It means a tool or person who is alerted when files change unexpectedly, when new administrators appear, when the site returns errors or when outgoing mail jumps. Daily malware scans, file integrity checks and uptime monitoring together cost little compared with a single bad incident. Whoever you choose, make sure alerts reach a real person who has the authority to act.
How NNT Software can help
NNT Software can review a store you think was compromised: check administrator users, recently changed files, scheduled tasks and search appearance, restore from a clean backup, patch PHP and plugins and rotate keys. After clean-up, many owners choose to move to a maintained platform with monitoring; we can quote that separately so you can compare.