×
Support
Services

How Can We Help?

Recovering After a Hack

Created On
Last Updated On
byPurpleCat Networks
You are here:
< All Topics

Recovering from a Hack can be overwhelming. Not only do you have to deal with restoring your site to a good working state, you also need to take steps to help prevent a repeated attack on your site. The following is a series of recommended steps for recovering from a hack (regardless of the nature of the hack). While this may seem overwhelming, this is an exhaustive list. You will want to try and close any open doors the hacker might have used (or may have left behind) to compromise your site.

Note! If you are not sure whether your site has been hacked or not, see our guide titled “I think my website has been hacked“.

Change Your Passwords

The first step you want to take is to make sure you change all passwords associated with your account. The following is a list of different passwords you will want to update.

Scan your Computer

Hacks can come to our servers through your local computer. When a computer is compromised by a virus, hack code can be uploaded to your site through FTP programs and HTML editors. When accessing the Internet, make sure the network you are on is secure. If it isn’t, or you aren’t sure if it is, do not connect to your cPanel/server (this includes using an FTP program, publishing from design software, logging into email, or logging into a CMS admin area). The following explains the steps to take to prevent hacks from your local computer.

  1. Update any anti virus programs you have on your local computer and run a full scan of local machine. If you do not have anti virus on your local computer, it is highly recommended that you install an anti virus program, keep it up to date, and run regular scans (yes this includes Mac and Linux users as well). Both AVG and Avast offer free anti virus programs from Windows, Linux and Mac users.
  2. If you use a wireless router to connect to the Internet, make sure it is a secured connection. If you are not sure how to secure your wireless router, consult your router’s documentation or do a search online for your router model and how to secure it. Your router manufacturer may also be able to assist you further.
  3. If you use any local web design/development software (e.g. Dreamweaver, iWeb, Microsoft Expression Web, etc.) make sure your software is up to date.
  4. Make sure that all Adobe products (including Adobe Acrobat and Adobe Acrobat Reader) are updated.
  5. Check your browser version and update as needed. If you have more than one browser installed on your computer, check all browsers installed.

If you antivirus software fails to detect any viruses, or you are having trouble removing a particular virus, several resources are available in which individuals will assist you in removing the virus for free:

Securing your cPanel

The cpanel is your hosting account control panel. It is recommended to secure your server through your cPanel. Below are steps to do this.

  1. Change your cPanel password.
  2. Make sure all of the FTP accounts listed are in use. If they are not, remove them. Make sure passwords for all FTP accounts have been changed.
  3. Check that all email accounts listed are in use. If there are any listed that are not in use, delete the accounts. Change your email account passwords.
  4. In the Email Forwarders area of cPanel, make sure any forwarders listed are ones that you created and are still forwarding from and to the correct email addresses.
  5. Review the Cron Jobs area of cPanel and make sure any cron jobs listed are legitimate and still contain the correct commands.
  6. Check the Simple DNS Zone Editor in cPanel. Under “User-Defined Records“, check for any records pointing site away that shouldn’t be there. Of course, if you use a third party for email or other services (like Google Apps for instance) you will expect to see records for those things. Just make sure that any DNS records listed are correct.
  7. In Redirects, review any redirects listed. If there are any redirects you did not create, remove them. If you have redirects you have created, make sure the redirection is still set up properly.

Update/Backup Software:

After you verify that your server and your computer is secure, you will want to secure other areas of your server like your CMS software and maintaining a backup.

Cleaning up Hacks:

Clean up a Code Injection

Typically code injections are carried out by an attacker uploading a PHP shell script to your account, either by compromising your FTP credentials, or by exploiting outdated software that you might have running on your website. If your site is trying to load malicious content for your visitors, or preventing your site from displaying properly, please see our guide on:
Cleaning up a code injection attack

Cleaning up a .htaccess Hack

The .htaccess file is used to primarily setup rewrite rules to control the way your site is accessed. You might not notice that your .htaccess file has been hacked until either a manual investigation, or you happen to get a malware warning on your website that it’s redirecting to a malicious site. The fix is explained in the following guide:
Cleaning up a .htaccess Hack

Reinstall WordPress after a Hack

In most cases when a WordPress site is hacked, it is because you are not running the latest secure version of WordPress, or one of the plugins that you have installed is outdated and has been used by a hacker to exploit the site. To get your site back up and running after a hack, see our guide on:
Reinstall WordPress after a Hack

Scan your Website

You can have your website scanned for vulnerabilities by using sites like those listed below. They have a “Free Online Website Malware Scanner” that you can use right from their front page. You can receive a scan, a report, and even additional assistance, if desired.

Malicious User Activity/Hacks, and How it Affects your Account:

The following article explains why stopping malicious user activity and hacks from running on your account, is important to keeping your account’s resource usage low:
Malicious User Activity and Hacks

We are here 24/7 to help you with your server. If you are hacked and need assistance, you can contact tech support to see if we can help. Even though coding support is beyond our support, we are always happy to see what we can do to help you get your site working.

Table of Contents