Photo: Lukas Blazek / Pexels. Illustrative photograph. Photo source · Pexels licence
If you suspect a compromise, treat it as an incident to investigate rather than a reason to delete unfamiliar files at random. Strange redirects, unexpected administrators or altered pages can have different causes. Preserve useful evidence and involve your host or a competent maintainer promptly.
Protect visitors and document what you observed
Record the visible symptoms, affected pages and timing. Ask the host about containment appropriate to the incident. If harmful content is being served, limiting public exposure may be necessary while the site is investigated.
Keep a protected copy of relevant logs and the affected state for analysis. Do not place that copy in a public download folder. Avoid sharing customer records, passwords or full configuration files in a public support thread.
Investigate the route in and the changes made
Review administrator access, recent software changes and available integrity checks. A malware scan can be useful, but a clean result alone does not prove the whole site is safe. Unsupported or untrusted software deserves particular attention.
The official WordPress hardening handbook discusses updates, strong authentication and reducing unnecessary exposure. Apply changes with an understanding of the installation rather than copying every security snippet into a live site.
Recover and verify carefully
A known clean backup may support recovery, but the entry point also needs addressing. Otherwise a restored site can be compromised again. Review affected credentials and access through a secure process, and check important functions before reopening normal operation.
Keep a record of what was confirmed, what was changed and what remains uncertain. Avoid promising that one plugin or a hidden version number makes a site invulnerable.
I can help review a WordPress issue within an agreed scope through WordPress support. Describe the visible symptoms without sending secrets, and see my work. Read How do I know whether my website backup actually works? for recovery preparation and Does hiding the WordPress version make my website secure? for the limits of obscuring software details.
The right first step is controlled containment and diagnosis. Permanent deletion without understanding the files can damage the site and remove evidence you still need.