Website Hacked? What to Do, Step by Step

Step 1: Contain the damage

• Put the site in maintenance mode or temporarily show a maintenance page. That way your visitors aren't exposed to malicious redirects and downloads.
• Preserve the evidence. Before you start cleaning up, take a copy of the site's files and database as they are right now. You need this copy to understand how the attack happened; don't mix it up with your clean backups.
• Tell your hosting company. Other sites on the server may be affected, and the support team can help you get to the logs.

Step 2: Change every password

The attacker may have got hold of a password. From a clean device, change all of these:

• Your hosting or server provider's client area
• The control panel (cPanel, DirectAdmin), FTP and SSH accounts
• The database user's password (and update it in the application's configuration file)
• All of the website's admin accounts
• API keys and the keys for payment and email services

After changing them, end any open sessions and turn on two-factor authentication wherever you can. If you suspect there may be malware on your own device, check it first; otherwise the new passwords can be stolen too.

Step 3: Find the way in and the changes

Finding where the attacker got in and what they changed is the most important part of the cleanup:

• Recently changed files: If you have SSH access, list the files changed in the last 7 days:

  find /var/www/site -type f -mtime -7 -printf '%TY-%Tm-%Td %p\n' | sort
  

• Scripts in upload folders: There should be no PHP files in image and document folders:

  find /var/www/site/wp-content/uploads -name "*.php"
  

• Suspicious code: Expressions such as eval(, base64_decode( and gzinflate( are common signs of obfuscated malicious code; on their own they're not proof, but they're worth looking into.
• Redirect rules: Check your .htaccess files for redirect rules you don't recognize.
• Users and scheduled tasks: Check the users in the admin panel, the crontab -l output on the server and the SSH authorized_keys files.
• Logs: In the web server's access logs, requests to suspicious files show when and how the attack happened.

The most common ways in are outdated plugins and themes, unlicensed (nulled) software, weak or leaked passwords and wrong file permissions.

Step 4: Clean up or go back to a clean backup

There are two routes:

Restoring from a clean backup: If you have a backup from before the attack, this is the fastest and most reliable route. If you don't know when the attack started, choose a backup that's old enough. After restoring, make sure you follow steps 2 and 5; if the hole isn't closed, the attack happens again.

Cleaning up by hand: If you don't have a clean backup:

1. Upload the application's core files again from the official source.
2. Delete your plugins and themes and reinstall them from their official sources; don't bring back the ones you don't use at all.
3. Clean out suspicious files in the upload folders and other content files.
4. In the database, clean out users you don't recognize, posts containing malicious scripts and settings.

Scanning the site with a security scanner helps you find files you missed. We explain why backups need to be tested in our Server backups guide.

Extra steps for WordPress

• Verify the core files. If you have WP-CLI access, the wp core verify-checksums command lists the WordPress core files that have been modified.
• Renew the security keys. Renewing the security keys (salts) in the wp-config.php file invalidates all sessions.
• Check the admins. On the Users page, review the accounts with the administrator role.
• Delete unlicensed plugins and themes. "Free" copies of paid plugins are one of the most common sources of malware.

We cover the basics of WordPress security in our How to install WordPress guide.

Step 5: Close the hole and harden

• Update the application, plugins and themes; replace the ones that are no longer developed with alternatives.
• Fix file permissions: 644 for files, 755 for folders; never use 777 anywhere.
• Protect access to the admin panel with two-factor authentication and strong passwords.
• If you manage your own server, follow our Linux server security checklist for the server-side steps.

Step 6: Tell search engines and users

• Google Search Console: Check the Security issues report and request a review once the site is clean. If spam pages were indexed, you can also request their removal.
• Users: If personal data was affected, inform your users and ask them to change their passwords. Data breaches may create a notification obligation under the data protection law in your country.

Security at Nodesty

Nodesty web hosting plans run with the Imunify360 security layer against malware and attacks and CloudLinux, which isolates accounts from each other; with JetBackup, you can reach your backups from the control panel. If you manage your own server on an AMD Ryzen 9 9950X VPS, free daily backups kept for 7 days let you go back to a clean point. If you suspect an attack, you can contact our support team.