A hacked website can show itself in different ways. It does not mean, however, that everything is lost. What matters is to act calmly and in the right order.
How to tell your website has been hacked
- The website redirects visitors to other sites or shows ads that are not yours.
- Foreign text (pharma, betting) appears next to your website in search results, or there is a warning that the website has been hacked.
- The website has gained unknown files or users with administrator permissions that you did not create.
- Spam is being sent from your website or mailbox, or messages are bouncing back with delivery failure reports.
- The browser shows a warning before entering the website.
- Server resources are unexplainably overloaded.
What to do
- Contact us. Write to us about what is happening and since when. We will help determine the extent and, if needed, temporarily restrict the website so the damage does not spread.
- Change all passwords: the hosting admin panel, FTP, database, email, and the application admin. Do it from a clean device (scan your computer with antivirus).
- Do not delete everything right away. The files can help determine how the attacker got in.
- Update the application core, the theme, and all plugins. Outdated add-ons are the most common way in.
- Restore a clean backup from before the attack, or have the website thoroughly cleaned. Keep in mind that the backup on the server is not intended for routine restores, see Backups. That is why it is good to keep your own backups too.
- Check the users in the application admin and delete any unknown ones.
- Check whether any further data was leaked. If the website contained customers' personal data, you may have a reporting obligation under the GDPR.
- Ask the search engine for a review (for example through Google Search Console) if the website is flagged as dangerous.
How to prevent an attack
- Regularly update the application, theme, and plugins. Remove add-ons you do not use.
- Use strong, unique passwords and two-factor authentication.
- Use encrypted transfers (SFTP, HTTPS).
- Back up regularly and store backups off the server.
- Use a current PHP version.