Websites
Website hacked: what do you do now?
Short answer
Put the site in maintenance mode, change every password and find out how the attacker got in before you restore anything. Restoring a clean backup from before the break-in is the fastest route, but only if you then close the hole: almost always an outdated plugin, a weak password or a forgotten old installation. Cleaning up without finding the cause means the site is infected again within a few weeks.
What do you do in the first hour?
Do not throw everything away in a panic. What you know now, you will need later to see what happened.
- Put the site in maintenance mode or ask the host to shield it. Visitors then run no risk and Google no longer sees infected pages.
- Make a copy of the infected site. Files and database. It sounds odd, but the traces are in there.
- Change the passwords. For the site admin, the hosting, the database and FTP. For every administrator.
- Check who is an administrator. An unknown account with admin rights is one of the first things an attacker creates.
- Call or email your host. They can often see in the logs when and how it started.
Clean up or restore a backup?
| Restore a backup | Clean up | |
|---|---|---|
| When | There is a backup from before the break-in | There is no usable backup, or you do not know when it started |
| Upside | The files are certainly clean | You lose no recent content or orders |
| Risk | Whatever was added after the backup is gone | Missing a backdoor |
| Afterwards | Close the hole, or you are hit again at once | Same |
The hard question is when the break-in began. A site can be infected for weeks before anyone notices. If you restore last week’s backup, you may restore the infection too. That is why a backup that reaches far enough back matters so much, and why you keep the copy from step 2.
With an online shop, restoring is harder, because orders have come in since the backup. Then the job becomes cleaning the files while keeping the database.
How do you find the hole?
Without a cause the job is not finished. Go through these:
- Which plugins and themes were behind? Compare the versions with the known holes. It is almost always here.
- Is anything old still on the server? A test version in a subfolder, an old site nobody maintains. One forgotten installation infects the rest.
- What do the logs say? The moment the first strange file appeared points to the way in.
- Did administrators have weak passwords? Or a password that was also used elsewhere and leaked there.
How do you keep it from coming back?
- Updates at a fixed rhythm. Every week, by someone who checks that the site still works afterwards.
- Fewer plugins. Every plugin is someone else’s code that you have to trust. Remove what you do not use; switching it off is not enough.
- Two-step verification for every administrator.
- A backup outside the server, that reaches back further than a few days.
- Each site in its own shielded space. On cheap hosting, sites sometimes share the same space, so one infected site takes the others with it.
This is not a one-off clean-up but maintenance. We do it as website maintenance, and on our WordPress hosting every site is shielded, with a daily backup on separate storage.
What if Google shows a warning?
Then Google has seen the infection and is warning visitors. That costs traffic for as long as it lasts. Clean up first and close the hole. Then request a new review through Google Search Console. If you do it too early, the request is rejected and it takes longer.
Also check whether pages were added that now show up in the search results. They must go, and their addresses must return an error instead of redirecting to the homepage.