A hacked brochure site is embarrassing. A hacked shop is worse, because the problem keeps costing you while it is live. Orders may still be arriving, customers may be logging in to their accounts, and a payment plugin is sitting in the middle of all of it, holding keys that connect your store to real money.
This page is about cleaning a WooCommerce store without losing the business that is still running through it. It sits within our wider hacked website repair and emergency help service, with extra steps that only matter when a site sells things.
Why a store needs a different cleanup
On an ordinary WordPress site, a common shortcut is to restore yesterday’s backup and move on. On a store, that shortcut can delete every order, refund, stock change and new customer account created since the backup was made. The fix creates a second problem, often a bigger one.
Stores also carry more that is worth stealing. Customer names, addresses, phone numbers and order histories sit in the database. Payment gateway API keys and webhook secrets live in plugin settings. Shipping and invoicing plugins may hold their own credentials. An attacker who gets into a store has more to take, and the owner has more to check afterwards.
Then there is the checkout itself. If the checkout page has been tampered with, the risk is no longer about your reputation in Google; it is about your customers’ cards. That specific situation has its own page on removing a credit card skimmer from a checkout, and if you suspect it, read that first.
Signs that point to a store problem rather than a general one
Some symptoms are shared with any hacked site: redirects, spam in Google, a host warning. Others are specific to shops, and they are worth knowing because they change what we do first.
- Orders arriving with addresses or names that look like test data, or many failed orders from the same customer in a short time.
- Payment settings you did not change: a different gateway account, an email address on a PayPal setting you do not own, or a gateway switched to test mode.
- Shop manager or administrator accounts nobody on your team created.
- Customers telling you the checkout looks different, asks for details twice, or sends them to an unfamiliar payment page.
- Coupons you never made, or prices and stock levels changed overnight.
- Emails from your payment provider or bank about suspicious activity linked to your store.
Any one of these on its own may have an innocent cause, such as a plugin update or a staff mistake. Two or more together deserve a proper look.
Keeping the shop open, or closing it for a while
This is the first decision we make with you, and it depends on what the attacker has touched.
If the checkout is clean and the problem is spam pages or a redirect elsewhere on the site, it is often reasonable to keep taking orders while we work, with extra care around the order tables. If the checkout or payment settings have been tampered with, we will advise pausing card payments, or switching temporarily to a method that sends the customer to the payment provider’s own page, until we know it is safe. A short pause is far cheaper than a customer’s card being taken on your site.
When closing fully is the right call, it should be done with a proper maintenance page that returns the correct status code to search engines, not by deleting the theme or renaming folders. That keeps search engines from treating the shop as gone.
How we protect your orders during the cleanup
Before we change anything, we take a complete backup of files and database and note the most recent order number. That number becomes our reference point. Whatever we restore or replace, orders after it must still be there at the end.
When files need replacing, we replace WordPress core, WooCommerce and its extensions with fresh copies from their official sources rather than rolling back the whole site. When database rows need cleaning, we work on the specific injected content and rogue accounts, not on the order data. If an older backup has to be used for some part of the site, we bring orders and customers forward from the live database afterwards, which is exactly the trap our article on when restoring a backup after a hack is safe describes.
Recent WooCommerce versions can store orders in their own dedicated tables instead of the general posts table. We check which storage your store uses before touching anything, because cleaning the wrong tables, or missing the right ones, is easy if you assume. Where scripts or rogue accounts have been planted in the database itself, the row-by-row approach is explained on our WordPress database cleanup page.
Payment plugins, keys and webhooks
Once the infection is removed, every secret the attacker could have seen has to be treated as known to them. For a store, that list is longer than for most sites:
- API keys and secrets for your payment gateway, such as Stripe, Razorpay, PayPal or another provider. New keys are created in the provider’s dashboard and entered in the plugin; the old ones are revoked.
- Webhook signing secrets, so fake payment notifications cannot mark unpaid orders as paid.
- WooCommerce REST API keys, which apps and integrations use to read and write orders.
- Credentials stored by shipping, invoicing, marketplace or accounting plugins.
We also check the gateway settings themselves: the account they point to, the payment flow chosen, and whether any setting was quietly switched. A redirected payout or a gateway set to accept test payments is not malware in the usual sense, so a scanner will not catch it.
Customers and their accounts
WooCommerce customers are WordPress users with the customer role, so a breach of the site’s users table affects them too. Depending on what we find, it may be sensible to force a password reset for customer accounts, and to check that no customer account has been given a higher role than it should have.
Whether and how you tell customers is your decision, and it may also be shaped by the law where you and they are located. Our post on telling customers after a website breach gives general information about that, not legal advice. What we can give you is a clear written account of what was exposed and what was not, which is what you need to make that decision well.
What to do now, if you run the store
- Note the time you first noticed something, and the latest order number you trust.
- Log in to your payment provider’s dashboard directly, not through a link in an email, and check recent payouts and account details.
- Do not delete the shop, the WooCommerce plugin or the database to “start fresh”. Order history is a business record you will want.
- Do not ask customers to re-enter card details on the site until the checkout has been checked.
- Change the hosting, WordPress admin and email passwords from a device you trust.
After the store is clean
We close with the same question we ask on every job: how did they get in? On stores, the answer is often an extension that had not been updated, an abandoned add-on, or a staff account with more access than it needed. Our explainer on the common ways websites get hacked lays out the usual routes in plain words.
Shops benefit from steady upkeep more than most sites, because WooCommerce and its extensions change often and a checkout that breaks after an update loses money just like a hack does. If you want that handled after the cleanup, our ecommerce website maintenance is the natural next step, and day-to-day store problems are covered by our WooCommerce support.
If your store is showing any of the signs above, send us a WhatsApp message beginning with the word HACKED and tell us your store address and what you have seen. We will look, tell you honestly what we think is going on and when we can start, and keep you posted on WhatsApp through the work. The full scope of a WordPress cleanup is described on our malware removal service page; the store-specific steps above are added to it.