Hacked website: what to do
Steps to stop an attack, clean malicious code and prevent it from happening again.
Signs of a hack: unknown pages or ads, redirects to other addresses, a browser or search engine warning, unexpected files or spam being sent from your domain.
- Do not panic and do not delete everything. First make a copy of the current state (Files → Backup or a download) for investigation.
- Change passwords: cPanel, FTP, database, WordPress administrators and email. See Account security and passwords.
- Enable 2FA: Two-factor authentication.
- Find what is infected. In File Manager sort files by modified date and look for unknown
.phpfiles, especially inwp-content/uploads. Check.htaccesstoo. - Restore a clean state. The fastest and safest option is restoring from a backup from before the attack.
- Update everything and remove unused plugins and themes: WordPress security.
Tell us#
Send a ticket describing the problem, when you noticed it and the site address. Tips for the ticket: What to include in a ticket. Do not send passwords.
After cleaning#
- Check the site in a browser using an incognito window.
- Make regular backups.
- If your site was marked as dangerous, request a re-check through the search engine's tools.
Messages claiming your site was hacked and demanding a payment are usually scams: Known scams.
Was this article helpful?
Thanks for your feedback! Need help? Open a ticket.
Related articles
Account security and passwordsPractical measures to protect cPanel, email and your site: strong passwords, updates and safe habits.WordPress securityBasic protection measures: updates, strong passwords, plugins, login protection and regular backups.Restoring from a backupHow to restore files and a database from a backup and what to do if you need help.Opening a ticketHow to send a request to support through the ticket system or by email.