Clean a hacked website on hosting

Signs of a hacked site include redirects to unknown pages, new administrator accounts you did not create, files you do not recognise, a browser or search engine warning, or a sudden flood of outgoing email. This guide takes you through recovery on web hosting, with extra steps for WordPress.

Before you start

• Open a ticket and tell us what you see. We can check the server side and help you with backups.
• Do not start by deleting files at random. Work through the steps in order.

Step 1: Write down what you see

Note what made you suspect a hack, when you first noticed it (with time zone) and what changed recently: a new plugin, a theme change, a new user. This record helps us, you and anyone you hire to find the cause.

Step 2: Keep a copy of the current state

Download a full copy of the files and the database as they are now; see back up and restore your hosting account. Label it clearly as infected. It is for reference only: never restore it later.

Step 3: Lock the attacker out

Change every password that gives access to the site, with long, unique passwords:

• the control panel (and your client area account, if it shares the password),
• every FTP and SFTP account,
• the database user (and put the new password in the site's configuration, such as wp-config.php),
• every administrator of the application, and remove users you do not know.

For WordPress, also replace the secret keys in wp-config.php with a new set from the WordPress key generator. This signs out everyone who is still logged in.

Step 4: Restore a clean backup, or rebuild in place

For other applications, replace the code with a clean copy from your own repository or the vendor, and keep only your content and configuration.

Step 5: Check with WP-CLI (if your plan has SSH)

If you can sign in over SSH and WP-CLI is available, compare the files with WordPress.org's checksums:

wp core verify-checksums
wp plugin verify-checksums --all

Verify: the core check ends with Success: WordPress installation verifies against checksums. Plugins that are not hosted on WordPress.org cannot be checked this way; reinstall them from the vendor.

Step 6: Close the hole

1. Update the application, every plugin and every theme to the newest version.
2. Change all passwords from step 3 again, now that the site is clean.
3. Look at your scheduled tasks (Cron Jobs in cPanel, Scheduled Tasks in Plesk) and remove any you did not create.
4. Apply the hardening steps in secure a WordPress site.

Step 7: Ask Google to review the site

If Google shows a warning for your site, open Google Search Console, then the Security issues report. Check that the example addresses it lists are clean, then select Request a review and describe what you removed and what you fixed. Google says a review can take from a few days to a few weeks.

Troubleshooting

The hack comes back after a few days. A backdoor is still in place, a stolen password still works, a scheduled task re-installs it, or the vulnerable plugin was not updated. Repeat steps 3 to 6 and open a ticket.

Your emails are rejected or end up in spam. The site may have been used to send spam. Clean the site first, then see email deliverability.

You cannot sign in to WordPress any more. Use Lost your password? on the login page. If the attacker changed your email address, ask us in a ticket to help you reset the account through the database.

Next steps

• Keep it from happening again: secure a WordPress site.
• Make sure you always have a clean copy: back up and restore your hosting account.