Was my site hacked before the PHP2Shell patch? An owner's checklist

Last checked October 21, 2026, at 10 p.m. Eastern.

Updating PHP closes the door PHP2Shell opened. It doesn’t evict anyone who already walked through it. That’s the part of this week’s news that gets skipped: if an attacker got in before your server was patched, they may have left a backdoor, and the patch won’t touch it. The UK’s National Cyber Security Centre told organizations that couldn’t patch immediately to look for “backdoors installed by an attacker” before upgrading.

Most owners can do a first pass in about 20 minutes without any technical background. This checklist is written for WordPress, since that’s where most PHP sites are, but the ideas carry over to Drupal, Joomla and the rest. If you’re still working out whether your site was exposed at all, start with our PHP2Shell guide.

Do I need to check whether my site was hacked?

If your host patched PHP on October 21 and the site behaves normally, your risk is low, and a quick pass is still worth it. If your site ran unpatched for days, sits on PHP 8.1 or older, or is acting strangely, check thoroughly. As of the evening of October 21, attack attempts were widely reported and confirmed break-ins weren’t, but quiet backdoors are designed to go unnoticed.

There’s a second reason to look this week. Two unrelated incidents planted backdoors in WordPress sites in the days before PHP2Shell, and they’re covered below.

What should I check first?

Work through these in order. Each one takes a few minutes.

1. Users. In WordPress, open Users and filter by Administrator, then by Editor. Look for accounts you don’t recognize, odd email addresses, or names like “support” or “admin2.” One of this week’s attacks created Editor accounts that quietly had admin powers.
2. Plugins. Open Plugins and read the whole list, including the Must-Use tab if you see one. Attackers like that tab because most owners never look at it. Watch for plugins you didn’t install, especially ones with bland names about maintenance, caching or health checks.
3. Uploads. In your host’s file manager, open wp-content/uploads. It should hold images and documents. A .php file in there is a red flag.
4. Recently changed files. Sort the main site folder by modified date. Files changed this week that nobody on your team touched deserve a closer look.
5. Google. In Search Console, open Security & Manual Actions, then Security issues. Then search Google for site:yourdomain.com and scan for pages you never wrote, often in another language or selling pills, casinos or knockoffs.
6. Behavior. Load the site on your phone, signed out. Watch for redirects to other sites, new pop-ups, or a sudden slowdown. Ask your host whether they’ve seen unusual resource use or outgoing email.
7. Scheduled tasks. In your hosting control panel, check cron jobs for anything you didn’t set up.

Your host can check what you can’t: server logs and whether PHP processes started programs they shouldn’t. CISA tells server operators to watch for PHP worker processes launching shells or downloading tools. Ask your host to look.

What else hit WordPress sites this week?

Two separate incidents, both unrelated to PHP2Shell, landed in the same week.

UpdraftCentral keys. TeamUpdraft, the company behind the UpdraftPlus backup plugin, says its website was breached over the weekend of October 17 and 18. Stolen UpdraftCentral connection keys were then used to install backdoor plugins and hidden accounts on connected sites. If you use UpdraftPlus with UpdraftCentral:

• update to UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium)
• delete the key under Settings → UpdraftPlus → Advanced Tools → UpdraftCentral
• check users and plugins as above, then change your admin passwords
• if anything looks off, restore a backup from before October 17

Patchstack, which tracked the attacks, adds one warning: if an unfamiliar plugin is crashing your site, don’t try to repair it. Fixing it can switch the backdoor on.

Rank Math SEO PRO. Rank Math says copies of PRO version 3.0.123 downloaded or updated between October 15 at 8:02 p.m. and October 16 at 7:12 a.m. UTC contained malware. The free version isn’t affected, and 3.0.124 is clean. If your site picked up 3.0.123 in that window and the plugin was active, Rank Math’s advice is to treat the site as compromised and restore a backup from before October 15.

I found something. What do I do now?

Slow down before you delete anything. A hasty cleanup tends to remove the visible mess and miss the way back in.

1. Save a copy of the site as it is now, and tell your host. Their team may need the files to find the entry point.
2. Change passwords: hosting, every WordPress admin, the database, FTP or SFTP, and the email accounts tied to the site.
3. Restore from a clean backup taken before the compromise, then confirm PHP is patched before the site goes back online.
4. Rotate keys stored in the site, such as payment, email-sending and API keys. These flaws can expose data held in server memory, so do this even if the obvious damage was small.
5. Remove unknown users and plugins from the restored site, and update everything.
6. Ask Google for a review in Search Console if it flagged the site.

If customer information may have been exposed, talk to your attorney early. Florida law sets deadlines for telling affected customers when certain personal information is breached, and the clock can start sooner than you’d expect.

When should I call a professional?

Call someone if you found anything on the list above, if the site takes payments or stores customer data, if you don’t have a backup from before the trouble started, or if you simply can’t tell. Hack cleanups go wrong when the backdoor survives, and a second cleanup usually costs more than the first.

We’re in Tampa, and this is work we can start today, on sites we built and sites we didn’t. Our hacked website repair service covers the full job: we lock the site down, find how the attacker got in, remove what they left, restore from clean files, change every credential, and get Google’s warning removed. You get a plain-language report at the end. Call 813-531-9400 and we’ll pick up, or send the details through emergency support.

Common questions

Will a security plugin catch this? A scanner can help find changed files and known malware, so run one. Plugin firewalls are a different story for PHP2Shell: Wordfence has said it’s still determining whether firewall protection is possible, because the attack targets PHP itself.

Should I restore a backup even if I’m not sure I was hacked? Not by default. Restoring rolls back every order, form and edit since the backup. Do the checks first, and restore when you find real evidence.

How long does a hacked site cleanup take? A clean restore with credential changes can be fast. A site with no good backup takes longer, because every file has to be checked. Set expectations in days, and be wary of anyone who promises minutes.

Will Google penalize my site? If Google flagged it, visitors see a warning until you clean up and request a review in Search Console. Rankings usually recover once the site is clean and stays that way.