Skip to main content

If your website has been hacked

Finding out that your website has been hacked is stressful, but it can be fixed. Most hacked sites are cleaned up by working through a clear order: lock attackers out, keep a copy for investigation, clean or restore, update, and then prevent a repeat. This guide is for website owners who suspect their site has been compromised, whatever software it runs on.

Signs that a site has been hacked​

  • Defacement: the home page or other pages show content you did not put there.
  • Spam redirects: visitors, often only those arriving from search engines or on phones, are sent to unrelated sites.
  • Unknown admin users in your website app, or unknown users in your hosting or FTP accounts.
  • Browser or search warnings, such as "Deceptive site ahead", or search results showing spam titles for your pages.
  • Strange files in your hosting account, such as PHP files with random names in upload folders.
  • Spam email sent from your domain, or a sudden rise in bounced messages.
  • A notice from your host that malware was found or that your account sent abusive traffic.

If you see any of these, act now rather than waiting to be sure.

Step 1: secure your accounts​

Change every password connected to the site, from a device you trust and know to be clean. Use a new, unique password for each.

  1. Hosting account: the account you use to sign in to your host.
  2. SFTP and FTP accounts: every file transfer account, including old ones you no longer use. Delete those.
  3. Database users: change the password, then update it in your website's configuration file so the site can still connect.
  4. Website admin accounts: every administrator in your website app. Remove any you do not recognize.
  5. Email accounts on the domain, especially if spam was sent from them.
  6. Two-step sign-in: turn it on wherever it is offered. See Protect your hosting account.

Step 2: keep a copy of the hacked state​

Before you change files, take a full backup of the current site: files and databases. Store it separately and label it clearly as infected. Do not restore it later. It is for investigation: it helps you, your host or a security professional find out how the attacker got in, so you can close that gap.

Step 3: clean up the site​

Restore a clean backup, if you have one​

The quickest clean-up is to restore a backup taken before the infection started. Choose one from a few days before the first sign of trouble, because attacks often sit quietly before they show. After restoring, your content will be as it was on that date, so note any changes you will need to redo.

A restored site still has the same weakness that let the attacker in, so carry on with the steps below.

If you have no clean backup​

  1. Reinstall the core files of your website app from the official source, using the same version or the latest one. Keep your configuration file and uploads, but check them.
  2. Reinstall plugins, themes and extensions from their official sources. Delete any you do not use, and any that are no longer maintained.
  3. Look for unknown files, especially PHP files in folders that should only hold images or uploads, and files changed recently that you did not edit.
  4. Check the database for unknown admin users, and for injected scripts or spam links in posts, pages and settings.
  5. Check .htaccess files and other server configuration files for redirect rules you did not add.
  6. Check scheduled tasks (cron jobs) for commands you do not recognize.

If the site is complex or the infection keeps coming back, consider asking a security professional to clean it.

Step 4: update everything​

Attackers usually get in through outdated software or a reused password. Update your website app, every plugin, theme and extension, and choose a supported PHP version. Remove anything you do not need: unused software can still be attacked.

Step 5: ask for a review if your site was flagged​

If browsers or search results warn visitors about your site, sign in to Google Search Console and open the security issues report. It lists what was found and on which pages. Once the site is clean, request a review there. Other search engines and security services have their own review processes; check each one that flagged you.

note

Warnings stay in place until a review confirms the site is clean. Request a review only after the clean-up is complete and you have checked the pages listed in the report.

Prevent it happening again​

  • Keep your website app, plugins and themes updated, and turn on automatic updates where it is safe to do so.
  • Use strong, unique passwords and two-step sign-in for every account.
  • Give each person their own account, with only the access they need.
  • Install plugins and themes only from official or trusted sources, never pirated copies.
  • Keep regular backups, and keep some copies away from the hosting account.
  • Use SFTP rather than plain FTP to upload files.
  • Never set file permissions to 777. Use the permissions your website app recommends.
At DomainPilot

DomainPilot web hosting has a web application firewall and malware scanning switched on. WordPress hosting includes a web application firewall on every plan, and malware scanning and removal from WP Grow. If you think your site has been hacked, contact DomainPilot support.

Did this article help you?