Hacked website: what to do
Steps to stop an attack, clean malicious code and prevent it from happening again.
Signs of a hack: unknown pages or ads, redirects to other addresses, a browser or search engine warning, unexpected files or spam being sent from your domain.
- Do not panic and do not delete everything. First make a copy of the current state (Files → Backup or a download) for investigation.
- Change passwords: cPanel, FTP, database, WordPress administrators and email. See Account security and passwords.
- Enable 2FA: Two-factor authentication.
- Find what is infected. In File Manager sort files by modified date and look for unknown
.phpfiles, especially inwp-content/uploads. Check.htaccesstoo. - Restore a clean state. The fastest and safest option is restoring from a backup from before the attack.
- Update everything and remove unused plugins and themes: WordPress security.
Tell us#
Send a ticket describing the problem, when you noticed it and the site address. Tips for the ticket: What to include in a ticket. Do not send passwords.
After cleaning#
- Check the site in a browser using an incognito window.
- Make regular backups.
- If your site was marked as dangerous, request a re-check through the search engine's tools.
Messages claiming your site was hacked and demanding a payment are usually scams: Known scams.
¿Te ha resultado útil este artículo?
¡Gracias por tu opinión! ¿Necesitas ayuda? Abre un ticket.
Artículos relacionados
Account security and passwordsPractical measures to protect cPanel, email and your site: strong passwords, updates and safe habits.WordPress securityBasic protection measures: updates, strong passwords, plugins, login protection and regular backups.Restoring from a backupHow to restore files and a database from a backup and what to do if you need help.Opening a ticketHow to send a request to support through the ticket system or by email.