Website hacked? What to do in the first two hours

Hacked website: the first two hours

In the first moment there's only one wish: to make it go away. That's exactly the most expensive mistake. A deleted malicious file takes with it the trace of how it got in, and without that trace the same person gets in again a week later. This article is about the order of things, not the tools.

First step

A copy, not a clean-up

Password changes

All of them, not just one

Most common way in

An old plugin

If you sell online

Stop taking orders

In order

The first two hours.

The order matters. Every step before the clean-up preserves something that can't be recovered afterwards.

Make a full copy — exactly as it is now

Files and database, infected, without touching anything. It's both the evidence and the insurance if the clean-up breaks the site. It takes minutes and is the one step that must not be skipped.

Take the site down or put up a maintenance page

An infected site sends out spam, shows other people's ads and can end up on Google's lists as dangerous. If you sell online — stop taking orders too.

Change the passwords, all of them

Hosting, database, FTP, administrators on the site, the domain's email. Changing only the admin password solves nothing if the way in was through FTP.

Look at who has access

New administrators with unfamiliar names are a classic sign. In WordPress: users sorted by registration date.

Check the file dates

Sort the files by modification date. Recently changed files in folders you haven't touched for months show you where to look.

Only now do you clean up

And, if possible, not by hand. Restoring from a clean copy from before the infection, plus updating everything, is more reliable than deleting what you've found.

Note

Six mistakes that make it worse.

Each is made with the best of intentions, and each complicates the next day.

Cleaning up without a copyA deleted file takes the trace of how it got in with it. If you don't know the way in, the clean-up is temporary, and you'll find out a week later.

Restoring from a backup that's already infectedIf you don't know exactly when it got in, going back one day often brings the infection back too. You need a backup from before the first odd change.

Updating straight away, before anyone has lookedAn update overwrites files — including the ones that show what happened. Update, yes, but after the copy.

Changing only the WordPress passwordIf the way in was through FTP, the database or the hosting panel, a new admin password stops no one.

Leaving deactivated plugins in placeA deactivated plugin doesn't run, but its files are still there and execute when called directly. Delete it; don't just deactivate it.

Keeping quiet with customersIf data passed through the site, silence costs more than the embarrassment. Check what data was accessible and what the law requires of you.

Afterwards

So it doesn't happen again.

Almost every case we've seen comes through one of these six gaps. None of them needs expensive measures.

Update, even when it's workingAn abandoned plugin is the most common way in. Not because it was bad, but because its vulnerability is publicly known and you haven't updated.

Remove everything unusedEvery plugin and every theme kept “just in case” is another door that someone else maintains for you.

Backups that aren't on the same serverA backup sitting next to the site gets infected along with it. A useful backup is somewhere else, and it's checked that it actually restores.

Two-step loginFor administrators and the hosting panel. It takes two minutes and stops the most common method — guessing passwords.

Fewer administratorsNot everyone who writes content needs to be an administrator. The “Editor” role does the same job with less risk.

Monitoring that tells you firstThe worst case is hearing it from a customer or from Google's warning. Maintenance usually covers exactly this.

Questions

Short answers.

If your question isn't here, call us — we answer by phone too.

+359 882 95 89 89

How do I know if my site has been hacked?

The usual signs: strange pages in Google's results, redirects to another site when opened on a phone, a sudden slowdown, a browser warning or an email from your hosting provider.

Sometimes there's no visible sign for months — the infection just sends spam from your server.

Can it be cleaned without losing content?

Usually, yes. The content sits in the database and is rarely touched — the malicious code is almost always in the files.

That's why the full copy at the start matters: the content can be extracted from it even if the site has to be rebuilt.

How long does it take?

For an ordinary case — hours. If the site is large, there are several infections or the way in can't be found, it takes days.

The longest part usually isn't the clean-up but getting off Google's lists of dangerous sites.

Is the hosting to blame?

Sometimes, but more often not. The vast majority of cases get in through an outdated plugin or a guessed password, not through the server.

If other sites on the same server are getting infected too, then it's a different conversation.

Do I need to change the domain?

Almost never. Even if the site was on a Google list as dangerous, after cleaning and a review request it comes off.

Changing the domain would also throw away all the visibility you've built up.

If it's happening now — call us.

With a hacked or crashed site, the phone is faster than the form. If it isn't urgent, describe what you're seeing.

+359 882 95 89 89 office@illumi.bg

Sofia, Bulgaria We reply within 24 hours In business since 2012