Docs → Recovery

Site down? Start here.

Find what you’re seeing in the list, do the steps in order, stop when it’s fixed.

Can’t log in Error or white screen Hacked or redirecting Content disappeared Everything is gone No backup

Before anything else. If you can still reach wp-admin, take a database-only backup now under Backup → Backup. It takes a minute and means nothing you do next can make things worse.

I can’t log in

Three different things look the same from the login screen. Work down the list.

When something looks wrong

The login page says you are locked out, or just refuses to load: Login protection or the firewall blocked your IP after failed attempts. Wait the lockout period (30 minutes by default) or log in from a different network — your phone’s data, not the same wifi — and press Clear all lockouts under Security → General, then add your IP to Allowed IPs under Security → Firewall.
Wrong password, and the reset email never arrives: The email is being sent through a server the host throttles. Have someone else with admin access log in and reset it for you under Users. If there is no one else: your host’s control panel can reset a WordPress password directly (Hostinger, SiteGround and most managed hosts have this), or their database tool can set a new one on the wp_users row.
The login page itself is a white screen or an error: That is not a login problem; skip to the next section.
You are logged in but wp-admin shows a blank page: A plugin broke the admin. Rename its folder over FTP or the host’s file manager: wp-content/plugins/the-plugin to the-plugin-off. WordPress deactivates it automatically. If you do not know which one, rename the whole plugins folder, log in, rename it back, and reactivate one at a time.

Related: Security → General · Firewall

The site shows an error or a white screen

Nearly always caused by something that changed in the last hour: a plugin or theme update, a new plugin, or a performance setting turned on. Undo the last change first.

When something looks wrong

It happened right after turning on minification, defer, or delayed JavaScript: Those settings rewrite your page code, and a theme that depends on load order can break. Visit yoursite.com/?mw_safe_mode=1 while logged in as an administrator. Every Performance setting switches off for visitors, the site comes back, and your saved settings are untouched. Then open Performance, turn off the setting that caused it, and turn safe mode off from the notice at the top of admin. If even that URL will not load, add define( 'MW_SAFE_MODE', true ); to wp-config.php above the line that says That’s all, stop editing; remove it once fixed. Last resort: rename wp-content/plugins/metawrench to metawrench-off over FTP, log in, rename it back.
It happened right after a plugin or theme update: Rename that plugin’s folder over FTP as described above. For a theme, rename its folder and WordPress falls back to a default theme; the site will look wrong but it will load, and you can restore a backup from there.
“Error establishing a database connection”: Not a plugin. Either the database server is down (ask your host; this is usually them), or the credentials in wp-config.php changed. If you just migrated, the new host gave you a different database name, user or password; update the four DB_ lines.
“There has been a critical error on this website”: WordPress emails the site admin the exact plugin or file that failed. Check that inbox, including spam. If SMTP was not set up, the email may never have arrived; add define( 'WP_DEBUG', true ); define( 'WP_DEBUG_DISPLAY', true ); to wp-config to see the error on screen, then remove it once fixed.
The site loads but looks completely broken: Usually cache. Clear under Performance → Cache, then your host’s cache, then hard-refresh. If still broken, a stylesheet is being minified or reduced that should not be: turn off Minify CSS and Reduce unused CSS and reload.
None of that worked: Restore the most recent backup: Backup → Restore → Full Restore. If you cannot reach wp-admin, see Everything is gone below.

Related: CSS / JS / HTML · Cache · Restore

The site is hacked or redirecting somewhere else

Visitors land on a spam page, Google shows a red warning, or there are pages on your site you never wrote. Do every step, in order; skipping one is how it comes back next week.

When something looks wrong

1. Find it: Security → Malware → Run Full Scan. Read the results for both files and database. Modified core files get Repair File. Modified plugin files get Reinstall Plugin. Anything unknown gets Quarantine. Database records are shown with table, row and column; open each in WordPress and remove the injected content.
2. Close the door: Change every password: all WordPress admin users, the database password in wp-config, FTP, and the hosting control panel. Delete any admin user you do not recognise under Users. Update every plugin and theme, and delete any that are inactive.
3. Lock it: Turn on Security → General: login protection, file protection, security headers. Turn on Security → Firewall with all three rules. Set Scheduled Scans to weekly.
4. Tell Google: Search Console → Security & Manual Actions. If there is a warning, press Request Review after the cleanup. The red screen clears in a day or two once Google re-crawls clean pages.
The redirect survives everything above: Check .htaccess in the site root and wp-content/uploads for PHP files, both over FTP. If it is still there, restore a backup from before the hack date — the 404 log and the firewall activity log tell you when the first strange requests appeared.
You had no scan and no backup: Your host may have daily backups for a fee; ask. Otherwise the honest path is a clean install of WordPress, reinstall plugins and theme from the official sources, and copy the database across after the database scan has cleaned it.

Related: Malware · Firewall · Restore

Pages or content have disappeared

Before restoring anything, check the two places WordPress hides things.

When something looks wrong

A page or post is missing: Pages → Trash. Anything deleted in the last 30 days is there with a Restore link. Also Pages → All, filter by Draft and Private; an accidental status change looks like a deletion.
A page is there but the content is wrong or blank: Open the page, find Revisions in the right-hand panel, and pick an earlier version. This only works if revisions were being kept; Cleanup under Performance keeps the last 5 by default.
Images are gone: Media → Library. If they are listed but broken, the files were deleted from wp-content/uploads while the database still references them; a Files Only restore brings them back without touching your content.
Menus, widgets or settings reset: Usually a theme switch, not a loss. Switch back to the right theme under Appearance and they return. If not, Database Only restore.
None of that found it: Backup → Restore → pick the most recent backup from before the loss → Database Only. Files are left alone, so nothing uploaded since is lost. You will be logged out; log in with the credentials from that date.

Related: Restore · Cleanup

Everything is gone

The site is a blank page, a host error, or the host account itself is closed. You need a backup archive and a working WordPress to put it on.

When something looks wrong

The site still exists and you can reach wp-admin: Backup → Restore → Full Restore from the most recent backup. A rollback copy is taken first, so if the restore fails, you are no worse off.
You cannot reach wp-admin, but the host is fine: Get the backup archive from wherever it was sent: Google Drive, Dropbox, S3, or download it from wp-content/mw-backups/ over FTP. Ask the host to reinstall WordPress fresh on the same account (most have a one-click installer). Install MetaWrench, then Backup → Migrate → upload the archive. The site address is the same, so nothing is rewritten.
The host is gone — account closed, company folded, bill unpaid: Same as above, on a new host. Install WordPress and MetaWrench there, point the domain at it, upload the archive under Migrate. If the domain moved too, Migrate rewrites every address to the new one.
The backup was on the server that is gone: Then it is gone with it. This is the reason every backup destination except Server sends the copy somewhere else. See the next section.
The restore finished but you cannot log in: Expected. The users table came from the backup; log in with the credentials from that date.

Related: Restore · Migrate

I don’t have a backup

There may still be one you did not make.

When something looks wrong

Ask the host: Most hosts keep daily snapshots for 7 to 30 days even on cheap plans, sometimes for a restore fee. Open a ticket and ask for the most recent one from before the problem.
Ask whoever built the site: Developers and agencies usually keep a copy of the sites they deliver.
Check your own computer and email: A downloaded backup zip, an export file, a copy of the theme. Even a partial copy shortens the rebuild.
The Wayback Machine: archive.org may have your pages. It will not give you a database, but it gives you the words and images to rebuild from.
So it never happens again: Backup → Backup → connect Google Drive or Dropbox → take one full backup now → Scheduled Backups: weekly, full, to that destination. Twenty minutes, once, and this page becomes something you never need.

Related: Backup