Discovering that your website has been hacked can be stressful, but acting quickly can help minimise damage and make the recovery process more efficient.
If you suspect that your website has been compromised, avoid making unnecessary changes until you have assessed the situation and identified the possible cause.
Signs That Your Website May Have Been Hacked
Some common signs of a compromised website include:
- Your website redirects visitors to another website.
- Unexpected pop-ups or advertisements appear.
- Your homepage or other pages have been modified without your permission.
- Unknown administrator accounts have been created.
- Your website is being used to send spam.
- Search engines display security warnings.
- Visitors report suspicious behaviour.
- Your website becomes unusually slow.
- Unknown files or folders appear in your hosting account.
- Antivirus software or security scanners detect malware.
Step 1: Change Your Passwords
As a precaution, change the passwords for accounts associated with your website, including:
- SIRSTEVEHQ Client Area.
- Hosting control panel.
- WordPress administrator accounts.
- FTP/SFTP accounts.
- SSH accounts.
- Database users.
- Email accounts.
Use strong, unique passwords for each account. If you suspect that your computer or device may also be compromised, secure the device before changing sensitive passwords.
Step 2: Scan Your Website for Malware
Run a malware scan to identify malicious files, scripts, or other suspicious activity.
If you use WordPress, a reputable security plugin can help identify malware and unexpected file changes. SIRSTEVEHQ also uses Imunify360 on supported hosting platforms to help detect and mitigate malware and other common security threats.
A malware scan can help identify affected files, but detecting and removing malware does not necessarily address the vulnerability that allowed the compromise.
Step 3: Update Your Website
Outdated software can contain known security vulnerabilities that attackers may exploit.
Ensure that the following are updated to supported versions:
- WordPress core.
- Themes.
- Plugins.
- CMS software.
- PHP version, where appropriate.
Updates often include security fixes for known vulnerabilities.
Step 4: Remove Unauthorised Access
Review all accounts and components associated with your website and remove anything you do not recognise.
Check for:
- Unknown administrator accounts.
- Unfamiliar plugins.
- Unknown themes.
- Suspicious files or folders.
- Unexpected scheduled tasks.
- Unauthorised configuration changes.
- Unknown FTP, SFTP, SSH, or database users.
Do not delete files or accounts unless you are confident they are malicious or unauthorised. Some legitimate files and processes may appear unfamiliar.
Step 5: Restore a Clean Backup
If you have a recent backup from before the compromise, restoring it may be an effective way to recover your website.
Before restoring a backup, make sure it is from a period before the compromise occurred. After restoration, update your software and address the vulnerability that allowed the attack.
Restoring an infected or compromised backup may reintroduce the problem.
Step 6: Identify How the Website Was Compromised
Removing malicious files alone may not resolve the underlying problem.
The compromise may have involved:
- An outdated plugin or theme.
- Weak or reused passwords.
- Stolen login credentials.
- A vulnerable application.
- Insecure custom code.
- An outdated CMS.
- Software downloaded from an untrusted source.
- Unauthorised access to an administrator or hosting account.
Identifying and addressing the underlying vulnerability is important to reduce the risk of another compromise.
Step 7: Check Your Website After Recovery
After cleaning or restoring your website, carefully review its functionality.
Check:
- Website pages.
- Contact forms.
- Images and media.
- Plugins and themes.
- User accounts.
- Online store functionality.
- Payment gateways.
- Search functionality.
- Website redirects.
- Important configuration settings.
This can help identify any remaining malicious changes or functionality that was affected during the compromise.
How Can I Prevent My Website from Being Hacked Again?
To improve your website's security:
- Keep WordPress, plugins, themes, and other software updated.
- Enable Two-Factor Authentication (2FA) where available.
- Use strong and unique passwords.
- Install software only from trusted developers.
- Remove unused plugins, themes, and applications.
- Use a valid SSL certificate.
- Maintain regular website backups.
- Monitor your website for suspicious activity.
- Scan your website periodically for malware.
- Review administrator and other user accounts regularly.
Following these practices can significantly reduce the risk of future compromises.
Can SIRSTEVEHQ Help?
Yes.
If you believe your website has been compromised, our Support Team can investigate whether the issue may be related to your hosting environment.
We can help identify hosting-related issues and provide guidance where possible. However, website owners remain responsible for the security of their websites, applications, themes, plugins, and custom code.
Depending on the nature and complexity of the compromise, you may also need assistance from your website developer or a specialist security professional to completely clean and secure the website.
Need Assistance?
If your website has been hacked, please open a support ticket through your SIRSTEVEHQ Client Area as soon as possible.
Include the following information:
- Your domain name.
- A description of the issue.
- When you first noticed the problem.
- Any recent changes made to your website.
- Any security or malware warnings you received.
- Any steps you have already taken.
Providing this information will help our Support Team investigate the issue more efficiently and advise you on the appropriate next steps.
