What to do if your website is hacked

Restoring a backup makes the symptoms disappear. If the vulnerability is still there, the compromise returns, often within days. Work through these steps in order.

1. Contain it

1. 1Take the site offline or into maintenance mode if it is serving malware or phishing content.
2. 2Change every password: control panel, FTP, database, CMS administrators, and any email account with the same password.
3. 3Revoke API keys and application passwords that could have been captured.

2. Find the entry point

This is the step most people skip and the only one that matters long term. Look for files modified around the time symptoms began, unexpected administrator accounts, and outdated plugins with known vulnerabilities.

• Check access logs for POST requests to unusual paths shortly before the first modified file.
• Compare CMS core files against a clean copy of the same version.
• Look for files in upload directories that should only contain images.

3. Clean and update

1. 1Restore from a backup taken before the compromise, if you have one you trust.
2. 2Update the CMS core, plugins and themes to current versions.
3. 3Remove plugins and themes you do not use. Inactive code is still reachable.
4. 4Re-check for injected content in the database, particularly in options and post content.

4. Harden before you go back online

• Enable two-factor authentication on all administrator accounts.
• Restrict administrator access by IP where practical.
• Set correct file permissions, and disable file editing from within the CMS.
• Set up scheduled scanning so the next attempt is found in hours, not weeks.