If your website was hacked, act in this order: save a copy, change every password, find and remove the malware, update everything, then check for leftovers.
Typical signs: visitors are sent to strange sites, unknown pages or ads appear, Google shows "This site may be hacked", your host or Imunify360 reports malware, or your domain suddenly sends spam. Stay calm and work through the steps below. You can also leave the work to us (see the end of this article).
1. Save a copy of the current state
Make a backup before you change anything, in cPanel's WordPress Management for WordPress sites (see Back up and restore a WordPress site), or download the site's folder from File Manager. The copy contains the malware, so never put it back online. It helps to find out later how the attacker got in.
2. Change every password
- Client area: Change your client area password, and turn on two-factor authentication (2FA).
- cPanel: Change or reset your cPanel password.
- WordPress: every administrator account. Use Setup in WordPress Management (see Log in to your WordPress dashboard).
- Database user: Change a database user's password, then enter the new password in
wp-config.php, or the site stops working. - Email accounts on the domain: Change an email account password.
Change them from a computer you trust. If your own computer has a virus, the new passwords can be stolen too.
3. Look for what the attacker left behind
- Imunify360: check the Malicious list for infected files (see Scan your website for malware with Imunify360).
- WordPress users: in WordPress, open Users and delete administrators you don't know.
- Plugins and themes: delete the ones you didn't install or don't use.
- Cron Jobs in cPanel: remove entries you didn't create (see Set up a cron job).
- File Manager: sort by Last Modified and look at files changed on days you didn't work on the site. PHP files in
wp-content/uploadsdon't belong there. - Email forwarders you didn't set up (see Forward email to another address).
4. Clean the site
- WordPress core files: Check WordPress Integrity and Reinstall WordPress Core in WordPress Management (see Remove malware from index.php).
- Plugins and themes: reinstall them from their official source rather than cleaning them by hand.
- A backup from before the attack can save time, if you're sure it's clean. Restore it, then update everything right away, because the old versions still have the hole the attacker used.
5. Close the hole
- Update WordPress, all plugins and themes, and turn on automatic updates (see Update WordPress, plugins and themes).
- Apply the security measures in WordPress Management (see Secure your WordPress site from cPanel).
- Use only plugins and themes that are still maintained, from sources you trust.
6. Clean up your reputation
- If Google shows a warning, request a review: Remove Google's "This site may be hacked" warning.
- If your domain sent spam, check your email settings: Fix email going to spam: SPF, DKIM and DMARC.
Let us do it: Website Security and Hack Recovery
ElySpace offers a Website Security and Hack Recovery service for malware removal, securing websites and recovering hacked sites. The plans cover one website, five websites or a business, and include malware removal and hack response, brand reputation and blacklist monitoring, backup, SSL certificate support, website recovery and 24/7 support. See the plans and order in the client area: Website Security and Hack Recovery.
Questions first? Open a ticket in the Website Security department and describe what you see.
Common questions
Should I delete the whole site and start again?
Only if you have a clean copy of your content. Deleting everything removes the malware, but also your work. Usually cleaning and updating is enough.
Was my hosting account hacked, or only the website?
Most attacks use a weak password or an outdated plugin on the website itself. Changing all passwords (step 2) closes both doors.
Related articles
- Scan your website for malware with Imunify360
- Remove malware from index.php
- Remove Google's "This site may be hacked" warning
- Security tips for your ElySpace account
Still stuck? Open a ticket in Website Security: Open a support ticket and we'll help.
