![\"\"](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2022\/11\/eBook-Speed-Up-your-website.png\/public\")
<\/a><\/figure>\n\n\n\n\n\n\n<\/p>
How to Check if Your Website Has Been Compromised<\/h2>
Before taking action to clean your website, you need to confirm whether it has been breached.<\/p>
The signs indicating that a website has been hacked vary and may even be invisible, depending on the type of attack. The following is a list of common indications that a site has been compromised:<\/p>
- \n
- Alerts about hacking from browsers and search engines.<\/li>\n\n\n\n
- Links redirecting to shady websites.<\/li>\n\n\n\n
- High volumes of traffic from other countries.<\/li>\n\n\n\n
- Defaced or broken webpages.<\/li>\n\n\n\n
- Slower load time than usual.<\/li>\n\n\n\n
- Google blocklist warnings.<\/li>\n\n\n\n
- Sent emails end up in spam.<\/li>\n\n\n\n
- Website takedown by hosting provider.<\/li>\n\n\n\n
- Unsavory advertisements.<\/li>\n\n\n\n
- White screen of death.<\/li>\n\n\n\n
- Random code fragments appearing on the header or footer.<\/li>\n<\/ul>
Plenty of website checkers like Sucuri SiteCheck<\/a>, DeHashed<\/a>, and Have I Been Pwned?<\/a> are available to confirm your suspicions. We recommend checking your website with more than one tool for more accurate results.<\/p>
10 Steps to Fix a Hacked Website<\/h2>
Once you have confirmed that your website has been hacked, take action to fix it. The following steps will guide you through the process of recovering and fixing your hacked website.<\/p>
1. Stay Calm and Don’t Panic<\/h3>
There’s no reason to panic – hacked websites are generally recoverable. Reacting emotionally without calmly evaluating the situation may lead to more harm than good.<\/p>
Therefore, remain composed and proceed to the next step.<\/p>
2. Change Your Passwords and Review Access<\/h3>
Brute-force attacks are some of the most common cybersecurity threats. Hackers attempt to guess the admin account’s password using various combinations of letters and numbers.<\/p>
Changing all of your passwords will revoke hackers’ access to your website and prevent them from compromising other accounts and causing more damage.<\/p>
Here’s a checklist of the accounts the passwords of which you’ll need to reset at the soonest opportunity:<\/p>
- \n
- Hosting account.<\/li>\n\n\n\n
- FTP accounts (primary and secondary).<\/li>\n\n\n\n
- Content management system admin account<\/a>.<\/li>\n\n\n\n
- Databases (do so via the database connection file).<\/li>\n\n\n\n
- Email accounts associated with the hacked website.<\/li>\n<\/ul>
\n\n\n
Important!<\/strong> If you have other accounts with the same login credentials as your hacked website, change them immediately. This applies to social media accounts, private email accounts, and other personal accounts. Keep in mind that you shouldn’t reuse passwords in the first place.<\/p><\/div>\n\n\n\n<\/p>
Besides changing all your passwords, we also recommend reviewing website user access privileges. If hackers manage to enter the site using an admin account, they will have full access to all the administration features.<\/p>
If the hacked website is hosted on WordPress, check the existing user roles and permissions<\/a> by accessing Users <\/strong>from the admin dashboard. Review accounts with super admin and admin roles as they have the highest level of access privileges.<\/p>
Follow the same procedure on platforms that grant access to multiple users, such as your hosting control panel and FTP account<\/a>.<\/p>
Set the appropriate permissions to your website files, particularly those in the root directory (public_html<\/strong>) like the wp-admin<\/strong> folder and wp-config.php file<\/a> via the web host’s File Manager. Doing so will prevent unauthorized users from accessing, modifying, and executing existing files.<\/p>
\n\n\n
\nPro Tip<\/h4>\n
Take advantage of a password generator <\/a> to manage your passwords and store password backups.<\/p>\n <\/div>\n\n\n\n<\/p>
3. Create a Backup of Your Website<\/h3>
Your website might have been hacked, but it’s still functional and has all the important data. By downloading a website backup<\/a>, you’ll be able to re-upload this website version and redo the cleanup process should it fail the first time.<\/p>
\n\n\n
Important!<\/strong> Keep the post-hack backup file separate from the older versions. The non-corrupted backup files will serve as your Plan B should the recovery process fail.<\/p><\/div>\n\n\n
\nExpert Tip<\/h4>\n
Try to store your website backup files at least in two different places – one on the cloud and one on a portable hard drive. <\/p>
Go for a system that can automatically create full incremental backups. It is important that the service is capable of detecting changes made after backups so that it will only sync those parts rather than going for a complete backup every time.<\/p>
Based on these criteria, any cloud storage should do the trick.<\/p>\n
\n\n![\"Editor\"](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2022\/05\/andreasgrant.png\/w=65,h=65,fit=scale-down\")
\n <\/div>\n \n4. Trace Back Your Actions<\/h3>
Most hack attempts happen after a website undergoes some changes, creating new vulnerabilities to exploit. By tracing back your actions, you should be able to identify the source of the security issues much faster.<\/p>
Narrow down the time window by checking your web logs for a sudden spike of traffic. Then, inspect your access logs<\/a> and error logs<\/a> through your hosting control panel to identify any suspicious activity or errors that occurred within the suspected time frame.<\/p>
![\"The](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2023\/03\/hpanel-performance-analytics-accesslogs.png\/public\")
<\/a><\/figure>After figuring out the time the hack occurred, examine all the changes you made before it. In WordPress, malicious code usually enters the site through new files introduced by plugins, themes, and WordPress core installations.<\/p>
\n\n\n
\nPro Tip<\/h4>\n
Hostinger users can find Access Logs<\/strong> under the Website<\/strong> section of hPanel. To access error logs, navigate to PHP Configuration<\/strong> in the Advanced<\/strong> directory.<\/p>\n <\/div>\n\n\n\n<\/p>
5. Investigate Recent Breaches Online<\/h3>
Even popular software may suffer from security breaches. Keeping yourself up-to-date with cyber security news will help you find the vulnerabilities much easier and remove faulty software before it can wreak havoc on your website.<\/p>
Here are some of the best cybersecurity websites our security experts recommend:<\/p>
- \n
- Hacker News<\/a> ‒ provides hacking news.<\/li>\n\n\n\n
- WP Hacked Help Blog<\/a> ‒ offers WordPress security tips on hacked website repair.<\/li>\n\n\n\n
- Daniel Miessler<\/a> ‒ publishes articles and tutorials about website security and technology in general.<\/li>\n\n\n\n
- IT Security Guru<\/a> ‒ focuses on cyber security, cyber crime, and ransomware.<\/li>\n\n\n\n
- Security Weekly Blog<\/a> ‒ provides weekly updates on cyber security in the form of live streams.<\/li>\n<\/ul>
\n\n\n
\nExpert Tip<\/h4>\n
One of the best ways to keep up with security breaches online is to set customized alerts. <\/p>
Depending on the type of news you are after, you can configure IFTTT or design scripts to receive notifications whenever a new topic is getting popular in the cybersecurity community. <\/p>
Besides that, remember to follow all the top security professionals and alert feeds of websites like SANS Internet Storm Center<\/a> and Have I Been Pwned<\/a>.<\/p>\n
\n\n\n <\/div>\n \n6. Talk With Your Hosting Provider<\/h3>
If your hacked website runs on shared hosting, the source of the security issues might originate from another website on the same shared server. In this case, cyber attacks could also target your hosting account.<\/p>
Contact your hosting company to check whether the other websites on the same server have also been attacked.<\/p>
Most web hosts also provide users with access to web logs, allowing you to monitor website visits. If server access logging is disabled by default, get in touch with your hosting provider or enable it manually.<\/p>
As a reminder, make sure to opt for secure web hosting<\/a> to prevent your site from hacking incidents. Here at Hostinger, we include anti-malware protection such as Monarx<\/a> in our shared plans.<\/p>
![\"Hostinger](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2023\/11\/Web-hosting_in-text-banner.png\/public\")
<\/a><\/figure>7. Investigate with Google Blocklist and Spam Blocklist<\/h3>
If Google detects suspicious or dangerous activity on a website, the search engine will likely block it. When a website gets blocklisted<\/a>, it won’t appear on search results to protect visitors from potential malware.<\/p>
Check whether your website ends up on Google Blocklist using Google Search Console<\/a>. The warning will appear in Security Issues<\/strong> under the Security & Manual Actions<\/strong> section.<\/p>
![\"The](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2022\/02\/no-issues-detected.png\/public\")
<\/a><\/figure>Google Safe Browsing<\/a> is another tool you can use to check your website’s status. It will let you know whether the site is safe to visit.<\/p>
If you don’t have access to the DNS zone editor<\/a>, examine your website traffic via Google Analytics<\/a>. Having a sudden drop in traffic will be a solid confirmation that Google has blocklisted your website.<\/p>
Besides Google Blocklist, your website might also appear on the anti-spam database. Internet service providers, mailbox providers, and anti-spam platforms use spam blocklists to prevent spam emails from entering their system. Emails from IP addresses listed on this blocklist will be blocked or end up in the spam folder.<\/p>
![\"Checking](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2022\/02\/mxtoolbox.png\/public\")
<\/a><\/figure>Clarify whether your domain is listed on the spam blocklist using domain health checkers like MxToolBox<\/a> and Domain DNS Health Checker<\/a>. Besides giving insights into the domain’s status, these tools can pinpoint issues related to your web server, mail server, and DNS.<\/p>
8. Reset Your .htaccess File<\/h3>
.htaccess<\/strong> is a file containing high-level configuration setups for a website hosted on the Apache Web Server. For this reason, .htaccess<\/strong> is a popular target of cyber attacks.<\/p>
Some of the most common .htaccess<\/strong> file exploits include:<\/p>
- \n
- Redirection from search engines to malware.<\/li>\n\n\n\n
- Redirection from error pages to malware.<\/li>\n\n\n\n
- Malware attachment to PHP files.<\/li>\n\n\n\n
- Information disclosure.<\/li>\n\n\n\n
- Browser fingerprinting<\/a>.<\/li>\n\n\n\n
- Watering hole attacks<\/a>.<\/li>\n<\/ul>
Disabling and restoring your .htaccess<\/strong> file to its original version might help troubleshoot the security issue. Additionally, change its file permissions so that only certain users can access it.<\/p>
\n\n\n
\nPro Tip<\/h4>\n
Hostinger users can locate and modify the .htaccess file<\/a> via hPanel’s File Manager<\/strong>.<\/p>\n <\/div>\n\n\n\n<\/p>
9. Examine Your Website and Fix the Vulnerability<\/h3>
Security vulnerabilities aren’t always visible to administrators. We recommend using website scanning tools to double-check your entire website for vulnerabilities and fix them.<\/p>
Use a Scanning Plugin or Tool<\/strong><\/p>
WordPress users have access to various free and premium security plugins, most of which can scan your website for compromised files and detect any malicious code.<\/p>
We recommend using plugins when recovering a hacked WordPress website<\/a>, as they help avoid misconfigurations that will worsen the situation. However, ensure they are reputable and up-to-date. <\/p>
Here are some of the most popular freemium WordPress security plugins<\/a> to consider:<\/p>
- \n
- Sucuri Security<\/a> ‒ provides server-side and remote scanning, post-hack security actions, and file integrity monitoring.<\/li>\n\n\n\n
- Wordfence<\/a> ‒ comes equipped with real-time firewall rules and malware signature updates.<\/li>\n\n\n\n
- Jetpack<\/a> ‒ offers malware scanning, real-time backups, and spam filtering.<\/li>\n\n\n\n
- BulletProof Security<\/a> ‒ provides setup wizard autofix, malware scanner, login monitoring, and force strong passwords tools.<\/li>\n\n\n\n
- WPScan<\/a> ‒ supports scheduled security scanning for known vulnerabilities of the WordPress core, plugins, and themes.<\/li>\n<\/ul>
Meanwhile, the following scanning tools are compatible with other CMSs besides WordPress:<\/p>
- \n
- HostedScan Security<\/a> ‒ performs vulnerability scanning on networks, servers, and websites.<\/li>\n\n\n\n
- Intruder<\/a> ‒ a cloud-based scanner that supports internal, external, and cloud vulnerability scanning.<\/li>\n\n\n\n
- Detectify<\/a> ‒ offers automated asset monitoring and testing supported by an ethical hacker community.<\/li>\n\n\n\n
- ImmuniWeb<\/a> ‒ provides various website security tests adhering to GDPR and PCI DSS standards.<\/li>\n\n\n\n
- SiteGuarding<\/a> ‒ supports search engine blocklist monitoring, daily file scanning, file change monitoring, and malware detection and cleanup.<\/li>\n<\/ul>
Make sure to follow the best WordPress security practices<\/a> to protect your site. <\/p>
\n\n\n
\nExpert Tip<\/h4>\n
Make sure the scanner manages to detect all the web applications that are part of your site. If the crawler is not able to crawl all the existing web applications, that leaves room for vulnerabilities. <\/p>
Another key feature to look for is how easy it is to integrate it with external tools. This is necessary if you want to automate most of the process.<\/p>\n
\n\n\n <\/div>\n \nScan Your Files and Database Tables Manually<\/strong><\/p>
Another way to detect and remove malware from your site<\/a> involves scanning the website files manually. You can do so with PC antivirus software like McAfee<\/a> and ESET<\/a> or your operating system’s built-in antivirus program ‒ Microsoft Defender<\/a> for Windows users and XProtect<\/a> for Mac users.<\/p>
Follow these steps to scan website files manually:<\/p>
- \n
- Download all the files via your hosting control panel. Hostinger users can download website files<\/a> through the Backups <\/strong>menu in hPanel.<\/li>\n<\/ol>
![\"The](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/2\/2023\/03\/hpanel-files-backups-sidebar.png\/public\")
<\/a><\/figure>- \n
- Perform a full scan of the files with your chosen antivirus software.<\/li>\n\n\n\n
- Resolve all the detected issues.<\/li>\n\n\n\n
- Upload the clean website files to the server.<\/li>\n<\/ol>
Next, clean up your database tables through phpMyAdmin<\/a>. Remove any records containing suspicious code as well as new records you don’t create. The easiest way to start is from tables that manage existing pages and posts (wp-posts<\/strong> and wp-options<\/strong> tables in WordPress).<\/p>
Hire a Cyber Security Expert<\/strong><\/p>
Website owners who don’t have technical knowledge may find the previous methods difficult. If this is the case, it’s best to entrust your hacked website to a cyber security expert. This method may be more costly than the other two, but it guarantees a successful cleanup and restoration of your website.<\/p>
Luckily, tons of cyber security agencies and specialists offer cleanup services to global customers. Some of the best cyber security companies include Palo Alto Networks<\/a>, and Bugcrowd<\/a>. Alternatively, find a cyber security expert on job search websites like LinkedIn and hire them as an independent contractor.<\/p>
When choosing a cyber security company or expert to work with, make sure to:<\/p>
- \n
- Check the company or expert’s reputation and portfolio.<\/li>\n\n\n\n
- Allocate a realistic budget to afford high-quality services.<\/li>\n\n\n\n
- Check the company or expert’s reviews.<\/li>\n\n\n\n
- Consider if you have easy access to a reliable support team.<\/li>\n<\/ul>
\n\n\n
\nPro Tip<\/h4>\n
Don’t fall for low prices as this usually indicates poor quality work, which can cause more issues on your site.<\/p>\n <\/div>\n\n\n\n<\/p>
Restore a Backup<\/strong><\/p>
If the previous methods seem too time-consuming or costly, you can restore the website backup file<\/a> instead. This method will remove any data and changes made since the backup was created, so we recommend resorting to this only if you can afford the data loss.<\/p>
For this reason, this method is best for fixing websites that don’t undergo frequent changes or are built for testing purposes.<\/p>
\n\n\n
\nPro Tip<\/h4>\n
After restoring the website backup, clear the browser cache<\/a> and flush the local DNS cache<\/a> to see the changes.<\/p>\n <\/div>\n\n\n\n<\/p>
10. Scan Your PC with Antivirus Software<\/h3>
The last step is to scan your computer for malware to make sure that whatever infected your website doesn’t compromise your machine as well.<\/p>
We recommended McAfee and ESET earlier as premium software. The following are some of the best free antivirus solutions to choose from:<\/p>
- \n
- AVG Free Antivirus<\/a><\/li>\n\n\n\n
- Avast<\/a><\/li>\n\n\n\n
- Avira Free<\/a><\/li>\n\n\n\n
- Kaspersky Security Cloud<\/a><\/li>\n\n\n\n
- Malwarebytes<\/a><\/li>\n<\/ul>
\n\n\n
\nPro Tip<\/h4>\n
Make sure to update your antivirus software before running a scan.<\/p>\n <\/div>\n\n\n\n<\/p>
How to Prevent Your Website From Being Hacked in the Future<\/h2>
Congratulations, you should have recovered the hacked website by this point. Unfortunately, there’s no guarantee that it won’t be compromised again in the future. That said, there are ways to minimize the risk of cyber attacks.<\/p>
Here are several basic tips to protect your website<\/a> from various types of malware:<\/p>
- \n
- Use cheap web hosting<\/a> providers wisely.<\/li>\n\n\n\n
- Remove outdated software you no longer need.<\/li>\n\n\n\n
- Use strong passwords.<\/li>\n\n\n\n
- Conduct website security audits<\/a> regularly.<\/li>\n\n\n\n
- Perform regular backups of your website.<\/li>\n\n\n\n
- Install an SSL certificate<\/a>.<\/li>\n\n\n\n
- Limit login attempts.<\/li>\n\n\n\n
- Enable two-factor authentication.<\/li>\n<\/ul>
Download WordPress Security Checklist<\/h3>
We’ve also compiled a security checklist to help WordPress users improve their site’s security measures.<\/p>
Download WordPress security checklist<\/a><\/p>
The practices may vary depending on your chosen content management system, but their purpose remains the same ‒ to protect your data and the target audience’s well-being.<\/p>
How to Communicate a Security Incident to Your Visitors<\/h2>
Aside from relying on the products and services you provide your visitors with, they also expect your brand to be able to protect their data. If your website is hacked, you risk losing trust and harming your brand’s credibility.<\/p>
That said, being transparent about security incidents is significantly better than hiding them from your target audience. Doing so might cause an outcry and hurt your brand, but you will warn them of the threat and minimize the damage on their end.<\/p>
Plus, if you’re subject to the GDPR law, you’re legally obligated to disclose any data breaches that might jeopardize your customers’ data security.<\/p>
If your site is compromised, make a formal announcement<\/strong> informing your audience about the data breach. If you have an email list, send a formal email<\/strong> containing the same information to your subscribers. Make sure it’s plain and clear so that the customers with limited technical knowledge can still understand it.<\/p>
The content of the announcement should explain the full extent of the breach<\/strong>, particularly the types of data that were leaked. Next, break down the remedial actions<\/strong> taken to mitigate the damage. The goal is to assure the audience that you take full responsibility for the incident and act with their best interests in mind.<\/p>
End it with suggestions on how to protect your audience’s personal data<\/strong> that might be affected by the data breach:<\/p>
- \n
- Update any exposed login credentials and security questions across all platforms.<\/li>\n\n\n\n
- Monitor accounts and credit reports.<\/li>\n\n\n\n
- Sign up for two-factor authentication.<\/li>\n\n\n\n
- Remove home address.<\/li>\n\n\n\n
- File a report to search engines if any of their private information shows up on search results.<\/li>\n<\/ul><\/a><\/figure>
Conclusion<\/h2>
The rapid evolution of cyber attacks is a major threat to any website on the web. If your website has been hacked, it’s best to take immediate action and mitigate the damage.<\/p>
Here’s a recap on how to fix a hacked website:<\/p>
- \n
- Change your passwords and review user access.<\/li>\n\n\n\n
- Create a backup of the website.<\/li>\n\n\n\n
- Trace back your actions to determine the exposed vulnerabilities.<\/li>\n\n\n\n
- Investigate recent breaches online.<\/li>\n\n\n\n
- Talk to your hosting provider to see if other users have also been affected.<\/li>\n\n\n\n
- Investigate with Google Blocklist.<\/li>\n\n\n\n
- Reset your .htaccess<\/strong> file.<\/li>\n\n\n\n
- Examine the website and fix the vulnerabilities.<\/li>\n\n\n\n
- Scan your computer with antivirus software.<\/li>\n<\/ol>
We hope this article has helped you recover your hacked website. If you’re a Hostinger user, feel free to contact our support team if you have any security questions or concerns. <\/p>
Hacked Website FAQ<\/h2>
Can a Hacked Website Be Recovered?<\/h3>
Yes, you can recover a hacked website by purging the malware and restoring a backup file. However, the process is rather technical. We recommend hiring a cyber security expert if you’re not confident in your technical skills to prevent further damage to the website.<\/p> <\/div>
How Do Hackers Get Into a Website?<\/h3>
In most cases, hackers gain access to websites through social engineering (persuading users to perform certain actions), brute-force attacks (cracking users’ passwords), and software vulnerabilities (code injection and malware). For more details, check out our article on how websites are hacked<\/a>.<\/p> <\/div>
Can a Hacker Be Traced?<\/h3>
Often, seasoned hackers generally work over Tor, VPNs, or a public network to conceal their identity.
In most cases, hackers get caught because they make careless mistakes, use the same code on multiple hacks, and brag about their actions on online forums.<\/p> <\/div> <\/div>\n","protected":false},"excerpt":{"rendered":"The rapid evolution of technology coincides with the rising number of cybersecurity threats. With 30,000 websites falling victim to hackers […]<\/p>\n
- Avast<\/a><\/li>\n\n\n\n
- AVG Free Antivirus<\/a><\/li>\n\n\n\n
- Intruder<\/a> ‒ a cloud-based scanner that supports internal, external, and cloud vulnerability scanning.<\/li>\n\n\n\n
- Wordfence<\/a> ‒ comes equipped with real-time firewall rules and malware signature updates.<\/li>\n\n\n\n
- Watering hole attacks<\/a>.<\/li>\n<\/ul>
- WP Hacked Help Blog<\/a> ‒ offers WordPress security tips on hacked website repair.<\/li>\n\n\n\n