My website or hosting has been hacked: how it happened and how to fix it

Attacks on websites are far more common than they seem, and you do not need to be a big brand to suffer one. Almost all of them are automatic: robots that crawl the internet looking for websites with known flaws. What they want is to use your site to host malware or phishing pages, send spam or redirect your visitors to other sites.

How they got in

In the vast majority of cases, through an application that has not been updated: WordPress, Joomla, PrestaShop, Drupal or, above all, one of their plugins, themes or modules. Updates fix security flaws; when one is released, the flaw becomes public and the robots start looking for websites that have not applied it.

Other common causes:

• Plugins or themes abandoned by their developer, which will never receive the fix for a discovered flaw.
• "Nulled" plugins or themes (paid versions downloaded for free from unofficial websites), which often come with a backdoor already built in.
• Stolen passwords for cPanel, FTP or the website's admin, usually because of a virus on the computer you connect from. We explain it in file infection through a compromised FTP account.
• Flaws in your own code, such as forms or file uploads without validation.

Each hosting account is isolated from the others: an attacker who gets into your account cannot reach another client's. In addition, the servers have a firewall, Imunify360 scanning files and processes in real time, and rules that filter web attacks. You can see these security measures, but none of them replaces keeping your application up to date.

What effects it has

• All the websites in the account affected. If you have several websites on the same hosting, a flaw in one is enough for the attacker to modify all of them: they share the same user and files.
• Spam sending. The attacker uploads scripts that send bulk email. Your domain ends up on blacklists and your legitimate emails start being rejected.
• Illegal content hosted: phishing pages imitating banks or companies, or files containing viruses.
• Faults on the website: blank pages, errors, strange content or redirects to other websites (sometimes only when arriving from Google or from a mobile).
• Google blocking. Google detects infected websites and flags them. With Safe Browsing, Chrome, Firefox and Safari show a red "dangerous site" warning to anyone trying to visit.

How to fix it

1. Scan the account

In cPanel, open Imunify360: you will see the files it has detected as malicious and you can clean them. You have the details in Imunify360. You can also use the cPanel virus scanner.

If the infection is serious or you do not know where to start, contact us: we have tools to detect and remove malware, backdoors and code injections, and every case is different.

2. Look for recently modified files

From the cPanel terminal, list the PHP files that have changed in the last 7 days:

find ~/public_html -name "*.php" -mtime -7 -ls

Change -7 to the number of days since the problem started. Pay particular attention to PHP files inside image or upload folders (in WordPress, wp-content/uploads should not contain any .php):

find ~/public_html/wp-content/uploads -name "*.php"

3. Check the administrators

Attackers often create an administrator user so they can get back in. In WordPress, from phpMyAdmin (SQL tab), this query lists the administrators, from newest to oldest:

SELECT u.ID, u.user_login, u.user_email, u.user_registered
FROM wp_users u
JOIN wp_usermeta m ON m.user_id = u.ID
WHERE m.meta_key = 'wp_capabilities'
  AND m.meta_value LIKE '%administrator%'
ORDER BY u.user_registered DESC;

If your installation uses another prefix, change wp_ in all three places. Delete any you do not recognise from Users in the WordPress dashboard.

Also check the Cron Jobs in cPanel: a cron job you did not create that downloads or runs a file is a common way of reinfecting the website. You have it in cron jobs.

4. Restore a backup if it cannot be cleaned

If the infection is very widespread, the quickest and safest thing is to restore a backup from a date before the attack. Bear in mind that you will lose whatever was added afterwards (orders, comments, posts). After restoring, still apply the steps below: the backup has the same flaw they got in through.

If you use WordPress, follow the guide on cleaning WordPress after an attack.

5. Close the door

Even if you have cleaned or restored, always do the following:

1. Update the application and all plugins, themes and modules.
2. Delete any applications, plugins and themes you do not use, including deactivated ones.
3. Change the passwords for cPanel, FTP, the database and all the website's administrators to long, unique ones. For cPanel, see change the cPanel and FTP password.
4. Run an antivirus on the computers you use to access the hosting.

6. Ask Google to remove the warning

If Google has flagged your website:

1. Add your website to Search Console if it is not already there: how to add your domain to Search Console.
2. Go to Security & Manual Actions > Security issues. There you will see the affected URLs and the type of problem.
3. When everything is clean, click Request Review and briefly explain what you have done.

Google usually takes a few days to review it. You have the official explanation in the Security issues report.

If you get hacked again

It is very common for the problem to reappear after cleaning: an attack can modify hundreds of files in seconds and leave a hidden backdoor that goes unnoticed. The best thing is to start from a completely clean backup, but if the attack went undetected for months you may not have one. In that case:

• Remove every plugin, theme and administrator user that is not essential, including deactivated ones.
• Remove plugins and themes that have not been updated by their developer for more than a year, and look for maintained alternatives.
• Reinstall the plugins and themes from their official sources (for WordPress, wordpress.org or the developer's website).
• Reinstall the application itself, overwriting its files with the originals of the same version. In WordPress, from Dashboard > Updates, with the button to reinstall the current version, or with wp core download --force --skip-content.
• Delete any file or application you do not need: old copies, test installations, old or backup folders inside public_html.
• If you have several websites in the same account, separate them into different hosting plans so that a flaw in one does not affect the others. Clean the website before moving it: moving it while infected just moves the problem.

If your website is with another provider

If the hacked website is hosted outside Hostsuar, we can bring it over and clean it at no cost when you sign up for any plan. What it includes and how to request it is in hacked website rescue.