My website has been hacked: step-by-step plan

A hacked website is annoying, but with a fixed step-by-step plan you can get it clean again and prevent it from happening again. The most important thing: just restoring a backup is not enough. If you don't know how the intruder got in, the door is still open.

How do you notice that your site has been hacked?

• Visitors end up on a different website, often only from Google or only on a phone.
• Google shows This site may be hacked next to your site, or strange pages from your domain appear in the search results.
• Your browser or virus scanner warns you about your own site.
• There are files or administrators in WordPress that you don't recognise.
• You receive a notification from us, or Imunify360 has found malware.
• Your mailbox is sending spam, or you suddenly reach the sending limit (see What to do if your e-mail address has been misused).

Step 1: stay calm and document everything

Don't throw everything away straight away. Note down what you see, when it started and take screenshots. You'll need this information later to find the cause, and so will we if you ask for help.

Step 2: change all passwords

Assume that an intruder knows a password. Change them all, preferably from a different computer than the one you normally use, in case it's infected:

1. Your My WebOké password. The extra code at login is always enabled there; if you'd rather use an authenticator app instead of the code by e-mail, set this up under My Administration and Login details.
2. Your DA password (see Setting or changing your DA password). This also applies to the default FTP account.
3. The passwords of extra FTP accounts (see Creating and managing FTP accounts). Remove accounts you no longer use.
4. All administrators in WordPress or your other CMS. Remove administrators you don't recognise.
5. The password of the database user (see Database users, privileges and passwords). Afterwards, also update it in your website's configuration file, such as wp-config.php.
6. Is a mailbox sending spam? Change that password too (see Changing the password of an email address).

Then enable Two-Step Authentication in DirectAdmin (see Setting up Two-Step Authentication).

Step 3: scan with Imunify360

In DirectAdmin, open the Imunify360 Plugin under Extra Features. There you can see which files have been found to be infected, and you can have your package scanned again. You can read how this works and what the notifications mean in Imunify360: scanning your website for malware.

Step 4: find out how the intruder got in

The most common causes, from frequent to rare:

1. Outdated software. An old version of WordPress, a plugin or a theme with a known vulnerability. Check in Installatron or in WordPress which components are out of date (see Updates and automatic updates).
2. A plugin or theme from an unreliable source. Free versions of paid plugins (nulled) often deliberately contain a backdoor.
3. A leaked or weak password. Check under Login History who logged into DirectAdmin and when (see Login History: who logged in and when?).
4. An infected computer on which FTP passwords are stored.

Useful places to look:

• In File Manager, sort by modification date. Files that were changed at the same time, especially in upload folders, deserve attention.
• In the access log under Site summary & logs, you can see which addresses are called frequently, often with POST requests to a single file (see Site summary & logs: the error log and the access log).

Step 5: clean up or restore a clean backup

You have two options:

• Restore a backup from before the hack. With WebOké Backups in My WebOké you can choose a point in time from the past 30 days yourself (see Can I also do this in My WebOké? WebOké Backups). Choose a moment before the first strange files appeared. Update everything immediately afterwards (step 6), because the vulnerability is also in the backup.
• Clean up yourself. Let Imunify360 clean the infected files, remove unknown files and reinstall WordPress and all plugins from the official source.

Please note: If in doubt, choose As a copy next to the current one first in WebOké Backups. That way, nothing changes to what's currently there and you can compare calmly.

Step 6: update everything and tidy up

• Update WordPress (or your other CMS), all plugins and themes to the latest version.
• Remove plugins and themes you don't use. Disabled plugins can also contain a vulnerability.
• Remove old copies and test installations in subfolders.
• Use an up-to-date PHP version (see Selecting the PHP version (Select PHP version)).

Step 7: aftercare

• Does Google show a warning? After cleaning up, request a new review in Google Search Console.
• Has your mailbox sent spam? Read What to do if your e-mail address has been misused and Verzenden geweigerd: blacklists en limieten.
• Keep the Web Application Firewall enabled (see Web Application Firewall).
• Check Imunify360 and your list of WordPress administrators occasionally over the coming weeks.

Need help?

Can't figure it out, or does it concern a webshop with customer data? Then create a ticket and tell us what you've already done (see Asking for help: what should you tell support?). If personal data is involved, you may need to report a data breach to the Autoriteit Persoonsgegevens.