• Free & Automatic Let's Encrypt SSL Certificates: Encrypts data in transit between your visitors and our servers.
   
• Imunify360 Firewall & Malware Protection: Blocks active brute-force attacks, malicious IPs, and known web exploits at the network level.
   
• Daily Backups & Malware Scans: Automatically scans hosted files for malicious signatures and generates daily backup snapshots.

Phase 1: What You Can Do Right Now (Client Actions)

1. Check Imunify360 for Detected Malware

• Log in to Plesk and navigate to Imunify360.
   
• Review the Malware Scanner tab to see if any malicious files have been automatically detected, cleaned, or quarantined by our server firewall.

2. Rotate Your Hosting & Account Passwords

• Immediately change your Plesk account password, FTP/SFTP passwords, and Database user credentials.
   
• If you still have access to your WordPress Admin dashboard (/wp-admin), change all Administrator account passwords immediately.

3. Turn On WordPress Debugging to Find the Root Cause

• Inside Plesk, go to WordPress Toolkit.
   
• Locate your website and toggle Debugging to ON (or enable WP_DEBUG in your wp-config.php file).
   
• Visit your website in a browser. Instead of a blank page or generic error, WordPress will display the exact file path and line number causing the crash (e.g., /wp-content/themes/Divi/header.php). Copy this error output to share with your developer!

4. Request a Server Backup Rollback from Rebel

• If the website is completely broken or unrecoverable, contact Rebel Support to request a backup rollback. Our team will restore a clean server snapshot from a date before the site was compromised.
   
• Important Note: A backup rollback replaces all site files and database entries with the selected snapshot. It restores site availability, but it does not patch the underlying security flaw that allowed the injection in the first place. Your developer must still audit and secure the site files.

5. Recommendation: Maintain Independent WordPress Backups

• While Rebel provides daily server-level backups, we strongly encourage keeping independent, application-level backups using plugins like UpdraftPlus, Duplicator, or All-in-One WP Migration. This gives you full control to download off-site backups directly to your local computer or personal cloud storage.

Phase 2: Technical Remediation Checklist (For Your Web Developer)

• Replace WordPress Core Files: Replace /wp-admin/, /wp-includes/, and root .php files with clean copies from WordPress.org (preserving /wp-content/ and wp-config.php).
   
• Audit the Uploads Directory: Check /wp-content/uploads/ to ensure it only contains static media and delete any stray .php or executable files.
   
• Clean Themes & Plugins: Update all active plugins/themes and completely delete any inactive extensions.
   
• Regenerate Authentication Salts & Passwords: Update secret security keys in wp-config.php to invalidate all active session tokens.
   
• Deploy Application-Level Security: Configure a Web Application Firewall (WAF) plugin (e.g., Wordfence, Sucuri) to monitor and block malicious software-level requests.

Rebuilding Safely via Staging Environments

• Have your web developer use the WordPress Toolkit inside Plesk to Clone your website into a private, isolated staging environment.
   
• Your developer can safely run core migrations, clean malicious files, and test plugin updates in staging without causing public downtime or errors on your live domain name.