Website hacked? Recovery plan for any site on cPanel hosting

Signs of a hacked site include unknown redirects, spam pages in Google, a browser "deceptive site" warning, strange admin users, or a notice from our team. Act quickly but in order: stopping the attacker comes before cleaning. This plan works for any PHP site; WordPress users should also read clean a hacked WordPress site.

Before you start

• Do not delete everything in a panic: backups and logs help find the cause.
• Open a support ticket early. MdmHost servers run Imunify360, and our team can scan the account and tell you which files are infected.

Step 1: contain

1. Change the cPanel password and turn on two-factor authentication; see password and security.
2. Change all FTP passwords and delete FTP accounts you do not need.
3. Change the CMS admin passwords and remove unknown admin users.
4. Change the database user password in Manage My Databases and update it in the site's config file.
5. Scan your own computers for malware; stolen FTP passwords often come from infected PCs.
6. Optional: put the site in maintenance mode or protect it with Directory Privacy while you work.

Step 2: find what changed

• Ask support for the Imunify360 scan results, or use the malware scanner in cPanel if available; see scan your website.
• List recently modified files in Terminal:
  Copy

  find ~/public_html -type f -mtime -7 -name "*.php" | head -50

• Look for PHP files in upload folders (they should only contain images), and for suspicious code such as long base64_decode or eval( strings:
  Copy

  grep -rl --include=*.php "eval(base64_decode" ~/public_html

• Check .htaccess files for redirects to unknown sites.
• Review Raw Access logs for POST requests to odd files; they show how the attacker got in.

Step 3: restore clean files

1. Find the last backup from before the hack in JetBackup 5.
2. Restore the site's files and, if content was changed, the database from the same date (restore a database).
3. If no clean backup exists, reinstall the CMS core from the official source, reinstall plugins/themes/modules from their official sources, and keep only your own uploads and configuration after checking them.

Step 4: close the hole

• Update the CMS, every plugin, theme and module to the latest version; remove anything abandoned or unused.
• Remove old test installs and staging copies; see remove apps.
• Use a current PHP version.
• Correct file permissions (files 644, folders 755).

Step 5: clean up afterwards

• Email: check Track Delivery for spam sent by scripts, and see deliverability.
• Google: in Search Console check Security issues, remove spam URLs and request a review.
• Cron jobs and forwarders: delete entries you did not create.

Next steps

• Keep apps updated automatically
• Block attacking IPs