Hacked Website: Recovery Steps in the Right Order

The signs usually appear suddenly. The home page shows an unfamiliar message, mobile visitors are redirected to gambling or ad sites, Google puts a warning next to the site’s name, or the host restricts the account for sending spam. In that moment, it’s tempting to rush and “delete a few suspicious files,” but without the right process, the site will be reinfected a few days later.

Step 1: Contain, don’t rush to clean

• If the site is sending visitors to malicious content, take it offline temporarily or show an “under maintenance” page.
• Notify your hosting provider; they may have logs and server-side scanning tools.
• Before making any change, take a separate copy of the current files and database. This copy is infected and must not be restored, but you need it to find the entry point.

Step 2: Change every password

The attacker may have your passwords. From a clean computer, change the following:

• The cPanel or hosting panel password, and enable two-factor authentication
• FTP accounts and the database user password, which must also be updated in the site’s configuration file
• The passwords of all site administrators, and remove any unknown admin users
• Passwords for mailboxes on the same host

In WordPress, also replace the security keys (Salts) in wp-config.php so that all active sessions, including the attacker’s, are invalidated.

Step 3: Restore from a clean backup or clean up

The fastest and most reliable route is to restore a backup taken before the infection. But the date of infection is not always the date it was discovered; check the modification dates of suspicious files and choose a backup older than that. If you don’t have a clean backup, manual cleanup is needed:

1. Replace the WordPress core with a fresh official copy.
2. Remove the plugins and theme and reinstall them from official sources; get rid of nulled versions.
3. Check the wp-content/uploads folder for PHP files; normally there should be no PHP files in this folder.
4. Check .htaccess files, scheduled tasks (Cron Jobs) in the hosting panel, and the database’s users and settings tables for anything unfamiliar.
5. Rescan the entire account with a server-side malware scanner or a reputable security plugin.

If you have several sites on one hosting account, check them all. An infection in an old, forgotten site can reinfect the other sites on the same account.

Step 4: Find and close the entry point

If you don’t figure out how the attacker got in, they will most likely come back the same way. The most common root causes are outdated plugins or themes with known vulnerabilities, nulled themes or plugins, weak or leaked passwords, and leftover access from former contractors. Server access logs from the infection period usually show suspicious requests to a specific file or plugin.

Step 5: Get back into search results

After cleanup, check the Security Issues section in Google Search Console and request a review. If the domain or IP was added to blocklists for sending spam, request removal once the problem is fixed. Keep the site under watch for several weeks and monitor file changes.

Checklist

• The site is contained and a separate copy of the infected state has been taken
• All passwords and security keys have been changed
• A restore from a clean backup or a full cleanup has been done
• The entry point has been identified and closed
• Google warnings and blocklists have been checked
• Regular backups and periodic updates are in place from now on

If your company’s site has been compromised, ITPlus724 engineers can handle the cleanup, recovery and closing of the entry point, and host the site on secure hosting with regular backups.