Repairing and securing a hacked site

If your website has been hacked despite your best efforts, it’s critical to act quickly. This guide explains how to secure your site, clean up malicious changes, and prevent future attacks.

Step 1: Determine the Cause

Most hacks occur due to:

• Compromised FTP/SSH passwords → Attackers gain direct access.

• Overly permissive file permissions → Files/directories set to 777 can be exploited.

• Software vulnerabilities → Outdated CMS, plugins, or applications leave openings for attackers.

Always check for outdated software and insecure plugins first.

Step 2: Look for Password Compromises

• Log in via SSH and review recent commands:

  Bash
  
  history

   

• Check the last login IP:

  Bash
  
  cat ~/.lastlogin
  

• If suspicious, change all account passwords immediately.

• Stop using plain FTP — switch to SFTP or SSH.

Step 3: Check for Software Vulnerabilities

• Update all applications (WordPress, Joomla, plugins, themes, etc.).

• Search for known plugin vulnerabilities online.

• Disable or remove insecure plugins.

• Review error logs in cPanel for clues.

Step 4: Clean Up After a Hack

Stop Malicious Processes

• List running processes:

  Bash
  
  ps faux
  

   

• Kill suspicious processes:

  Bash
  
  kill process_id
  

   

Remove Hacked Files

• Show hidden files in FTP or SSH (ls -a).

• Search for recently modified files:

  Bash
  
  find . -mtime -3
  

   

• Delete files you didn’t create.

Reset File Permissions

• Directories → 755

• Files → 644

  Bash
  
  find . -type d -exec chmod -c 755 {} \;
  find . -type f -exec chmod -c 644 {} \;
  

Restore Databases

• Check for malicious SQL injections.

• Restore from a clean backup if needed.

Restore Lost/Modified Files

• Use Server Rewind in cPanel to recover files from the past month.

Step 5: Reconfigure WordPress (if applicable)

• Reset WordPress security keys in wp-config.php.

• Update all plugins/themes.

• Harden login security (limit attempts, enable reCAPTCHA).

Step 6: Request a Google Review

• After cleanup, request Google to review your site in Search Console.

• Once verified safe, Google will remove the “Deceptive Site Ahead” warning.

Step 7: Prevent Future Attacks

• Enable Cloudflare for DDoS protection and bot filtering.

• Keep software updated.

• Use strong passwords and SSH keys.

• Monitor logs regularly.