Unexplained CPU usage, outgoing spam, unknown users or an abuse report from your provider can all mean a compromised VPS. Acting calmly and in the right order limits damage and stops it happening again.
Before you start
- Access to your VPS panel (console, snapshots, firewall) and your provider's support.
- A clean computer to work from; if you suspect your own machine is compromised, use another.
Signs of compromise
- Unknown processes using high CPU (often crypto miners) or connecting out to odd IPs.
- New users, SSH keys in
authorized_keysyou did not add, or changed sudoers. - Unfamiliar cron jobs or systemd services.
- Outgoing spam, abuse complaints, or your IP on blocklists.
- Modified website files, web shells in upload folders.
Contain
- If the server is attacking others or sending spam, restrict it immediately: use the panel firewall to block outbound traffic except your own access, or power it off.
- Tell your provider if they sent an abuse notice, explaining what you are doing.
Preserve evidence
- Take a snapshot or disk image before changing anything, if possible.
- Copy logs off the server:
/var/log/auth.logor/var/log/secure, web server logs,journalctloutput. - Note running processes and network connections:
ps auxf,ss -tunap.
Find the entry point
- SSH: successful logins from unknown IPs in auth logs, weak passwords.
- Web apps: outdated CMS, plugins, or vulnerable code; look for suspicious POST requests in access logs.
- Exposed services: databases, admin panels or Docker API open to the internet.
- Leaked credentials: API keys or passwords in public repositories.
Recover: rebuild, don't just clean
Attackers often leave backdoors you will not find. The safe path:
- Reinstall the OS from a clean template; see reinstall checklist.
- Harden first: first steps on a new VPS, SSH lockdown.
- Restore data from a backup taken before the compromise, and review it for injected code.
- Update all software to current versions and fix the entry point.
Rotate credentials
- Server passwords and SSH keys, database passwords, application secrets, API tokens.
- Panel and hosting account passwords; enable 2FA.
- Any credentials stored on the server, including third-party services.
Prevent a repeat
- Automatic security updates and regular Lynis audits.
- fail2ban, firewall with minimal open ports, private admin access via VPN.
- Monitoring and alerts for CPU, outbound traffic and logins.
- Tested, off-site, ideally immutable backups.
Frequently asked questions
Can I just delete the malware?
Removing visible malware rarely removes everything. Rebuilding is far more reliable.
Do I need to report the breach?
If personal data was exposed, laws such as GDPR may require notification. Seek legal advice.
My website on shared hosting was hacked, what now?
See WordPress hacked site cleanup and contact support.