Your website has been hacked: the first steps, in the right order
PrintFinding out your website was hacked is alarming, but panic does more damage than the attack itself. Most compromised websites can be brought back, as long as you do not wipe out the evidence and you close the attacker's way in before anything else. The order of the steps below matters.
How to tell the website was hacked
- Visitors get sent to other websites, often only those arriving from a phone or from Google, so you may see nothing wrong yourself.
- Pages, links, text in foreign languages or admin users appear that you never created.
- Browsers show a dangerous-site warning, or Google labels the site in search results as possibly hacked.
- You received an Imunify360 notice from us about malicious files or spam being sent.
What to do right away
- Record what you see. Take screenshots and note the affected page addresses, the date and the time. These details go a long way in tracing the cause.
- Save a copy of the current state. Download the files and the database exactly as they are, infected or not. Keep this copy in a separate folder with an obvious name (such as "infected-date") so it never gets mixed up with a clean backup.
- Check your computer. Run a full antivirus scan on every computer you use for cPanel, FTP or the website admin. Spyware would simply steal the passwords you are about to change.
- Change passwords from a clean computer: the TopHost client area, cPanel, every FTP account, the database users (then update the website's configuration file), the CMS admin accounts and the mailboxes.
- Look for back doors. In cPanel, review FTP Accounts, Forwarders (mail forwarding) and Cron Jobs. Attackers often leave an extra FTP account, a mail forwarder or a scheduled task that reinfects the website. In the CMS, review the list of users with admin rights.
- Get in touch. Open a ticket describing what you noticed and what you have already done.
Mistakes that make it worse
- Deleting files at random. You may remove files the website needs and it will not start at all.
- Restoring a backup before changing passwords. The attacker still has access and is back within hours.
- Paying someone who offers to "unlock" the website. There is no guarantee, and the money is gone.
- Ignoring our notice. Under the Terms and Conditions, once you are notified about malicious files you have 24 hours to act and let us know. If the threat is serious, the account can be blocked straight away to protect other clients.
Cleaning up and getting back online
- In cPanel, open Security, then Imunify360, and read the list of files the scan found.
- If you roughly know when the trouble began, restore a copy from before that date with JetBackup 5. Copies are kept on a 30-day rotation, so do not wait. See restoring with JetBackup 5.
- Update the CMS, themes and plugins. For WordPress the easiest route is cPanel with WP Toolkit; the WordPress dashboard is the alternative.
- Remove every plugin and theme you are not using.
- Turn on two-factor authentication wherever it is offered.
- If Google or browsers flagged the website, ask for a new review once it is clean. See what to do about a website marked as fraudulent.
Other questions
What can the TopHost team do?
We can tell you what Imunify360 found, help with restoring backups and look through the server logs to see where the suspicious requests came from. Cleaning the website's code and fixing flaws in the CMS or plugins remain your job or your developer's.
Do I have to report it to anyone?
If the attack may have exposed your customers' personal data (names, phone numbers, addresses, orders), you may be legally required to tell the data-protection authority. In the Republic of Moldova that is the National Center for Personal Data Protection (datepersonale.md). If you have customers in the European Union, the GDPR applies as well and generally expects notification within 72 hours (GDPR Art. 33). For your specific case, ask a lawyer.
Where did the attacker come in?
Usually via a plugin or theme that was not updated, or via a password that was stolen or too simple. Unless you find and close that gap, the infection will return even after a successful clean-up. The checklist in detecting viruses or malicious code helps you track it down.
