If your WordPress site has been compromised, the first priority is to stop further damage and restore control.
This guide explains how to use All In One WP Security after hack events to secure accounts, reduce attack surface, and harden the site before you put it back into normal use.
What All In One WP Security can and cannot do after a hack
All In One WP Security is a hardening plugin for WordPress, not a malware cleaner.
It helps you reduce risk by tightening login protections, restricting access, and improving core security settings, but it does not replace a full malware scan or manual cleanup if files have been altered.
After a breach, use it as part of a recovery process that also includes hosting-level checks, core file verification, and password resets.
The plugin is especially useful for closing the most common entry points that attackers exploit again if they are not addressed quickly.
First steps before changing settings
Before making security changes, confirm that you still have administrator access and that your hosting account is safe.
If an attacker has access to your email, FTP, or hosting panel, WordPress changes alone may not be enough.
- Change your hosting, cPanel, SFTP, and database passwords.
- Reset passwords for all WordPress administrators.
- Back up the current site files and database for forensic review.
- Check whether new admin users, unknown plugins, or modified themes were added.
Once you have control of the environment, install or open All In One WP Security and work through its sections in a deliberate order.
How to use All In One WP Security after hack
The best way to use All In One WP Security after hack incidents is to focus on the settings that block repeat attacks.
Start with user authentication, then move to file access, login protection, and database hardening.
1. Audit administrator accounts
Open the Users section and review every account with administrator privileges.
Delete or downgrade any account you do not recognize, and compare email addresses, display names, and role assignments carefully.
- Remove dormant admin accounts created for temporary access.
- Change usernames that are easy to guess if the plugin allows it.
- Ensure each legitimate user has a unique strong password.
If the hack involved a stolen password, assume the attacker may have created a second backdoor account.
A clean user audit is one of the most important recovery steps.
2. Strengthen login security
Attackers often return through brute-force login attempts, so login protection should be configured immediately.
All In One WP Security includes tools for login lockdown, failed login monitoring, and CAPTCHA-based defenses.
- Enable login lockdown after a set number of failed attempts.
- Use CAPTCHA on the login page and password reset page.
- Rename the default login URL if your workflow allows it.
- Limit login attempts from the same IP address.
These settings are useful because credential stuffing and brute-force scripts are still common on WordPress sites.
Even a simple slowdown can reduce automated attack success significantly.
3. Protect the admin area
Once login security is set, protect the admin dashboard itself.
The plugin can restrict access by IP address and add extra barriers around sensitive backend pages.
Use these features carefully if your team works remotely or changes networks often.
IP restrictions are effective for small teams with fixed office connections, but they can create lockout problems for mobile or distributed users.
- Restrict wp-admin access where practical.
- Enable additional authentication on sensitive pages.
- Log and review repeated admin access attempts.
4. Harden file permissions and editing options
Many attackers modify theme files, inject malicious PHP, or use the built-in theme and plugin editor to plant code.
All In One WP Security can help reduce that risk by tightening file-related settings.
- Disable file editing from the WordPress dashboard.
- Set proper permissions for wp-config.php and other core files.
- Review uploads directories for unexpected PHP files.
- Keep themes and plugins updated or remove unused ones entirely.
Disabling dashboard file editing is especially useful after cleanup because it removes one of the easiest ways for a compromised admin session to turn into persistent malware.
5. Update database prefix and protect database access
Some WordPress attacks depend on predictable database structure.
If your site was built with the default table prefix, the plugin can help you change it to a less common value, which adds a small but meaningful layer of obscurity.
Also verify that the database user has only the permissions it needs.
Excessive database privileges can make a compromise far worse if malware reaches application credentials.
- Change the table prefix if it is still the default wp_.
- Confirm strong database passwords.
- Limit database user privileges to the minimum required.
6. Turn on firewall-like protection features
All In One WP Security includes basic firewall-oriented options that can block suspicious requests and reduce common exploitation patterns.
While it is not a full web application firewall like Cloudflare WAF or Sucuri Firewall, it can still provide useful defense-in-depth.
Review features such as blocking suspicious query strings, filtering bad bots, and preventing access to sensitive files.
These settings are most effective when paired with server-side protections from your host or CDN.
Which settings should you prioritize first?
If you are working under time pressure, use this order of operations:
- Remove unknown users and reset all passwords.
- Enable login lockdown and CAPTCHA.
- Disable file editing.
- Check file permissions and suspicious uploads.
- Harden the database settings.
- Review firewall-style protections and access restrictions.
This sequence addresses the most common ways a hacked site is reinfected.
It also reduces the chance that an attacker can use one compromised credential to regain control.
How to verify the site is actually clean
Security hardening is only part of recovery.
After you configure the plugin, confirm that the site no longer contains malicious code, hidden redirects, or spam links.
Use your hosting malware scanner, a reputable WordPress security scanner, and manual inspection of recent file changes.
- Check wp-config.php, .htaccess, and theme functions files.
- Review recently modified files in wp-content.
- Inspect scheduled tasks and cron jobs for unknown entries.
- Search the database for spammy or injected content.
If you find recurring reinfection, the problem may be outside WordPress, such as a stolen hosting password or vulnerable server software.
In that case, hardening the site without fixing the root access issue will not solve the problem.
Useful All In One WP Security features for long-term protection
After the emergency response, keep the plugin configured as part of ongoing maintenance.
The strongest gains usually come from a few practical settings rather than enabling every option blindly.
- Brute force protection: blocks repeated login attempts.
- User account security: reduces risk from weak or duplicated roles.
- File system security: makes file-based attacks harder.
- Database security: improves resilience against predictable configurations.
- Comment and spam controls: reduce low-level abuse and bot traffic.
Revisit these settings after major updates, staff changes, or a hosting migration.
Security that is correct today can become weak again if passwords, roles, or access methods change later.
Common mistakes to avoid after a WordPress hack
Many site owners rush to restore pages without fully securing the environment.
That often leads to a second breach within days.
- Do not rely on the plugin to remove malware from infected files.
- Do not keep unused admin accounts active.
- Do not leave the default login page unprotected if brute-force attacks were involved.
- Do not skip hosting and email password resets.
- Do not assume a visual clean-up means the site is actually safe.
Security tools work best when paired with disciplined recovery steps and regular monitoring.
The plugin is a strong helper, but it is most effective when you treat the whole environment as suspect until verified.
When to call a professional
If the hack involved defacement, redirects, phishing pages, or repeated reinfection, bring in a WordPress security specialist or your hosting provider’s incident response team.
Professional help is also a good idea when you cannot determine whether the attacker still has access to another admin, server account, or third-party integration.
For business sites, speed matters, but accuracy matters more.
A thorough recovery backed by clean credentials, verified files, and locked-down WordPress settings is the safest way to rebuild trust.