Decision framework
Compromised website triage and cleanup or Malware, redirect, and unauthorized-user investigation?
Compromised website triage and cleanup and malware, redirect, and unauthorized-user investigation can both be reasonable responses to visitors see suspicious redirects, but they solve different layers of the problem. The right choice depends on the operating result, not the more impressive label.
Choose Compromised website triage and cleanup when
This path fits when the core need can be addressed within the current system boundary and website and WordPress incident response is understood well enough to test safely.
- Visitors see suspicious redirects
- Website and WordPress incident response
- File, account and configuration review
Choose Malware, redirect, and unauthorized-user investigation when
This path fits when the current behavior is only a symptom of a broader workflow, ownership, or platform limitation involving backup validation and restoration.
- Search engines or browsers show warnings
- Unknown users or files have appeared
- Backup validation and restoration
Compare the tradeoffs
Evaluate time to useful value, migration risk, reversibility, user disruption, and long-term ownership. Avoid treating feature count as a substitute for fit.
- Time to verified result
- Data and access risk
- Maintenance responsibility
- Ability to reverse course
A low-risk decision sequence
Inspect the existing state, prove the most uncertain assumption, and write acceptance checks for both paths. Choose only after the evidence explains which boundary must change.
- Inventory
- Focused test
- Decision record
- Scoped implementation