Recover a hacked website

If your website shows strange content, redirects visitors elsewhere, sends spam, or has been flagged by Google or your antivirus, it has probably been hacked. Follow these steps to clean it up and stop it from happening again.

Most websites are hacked through out-of-date software: an old version of WordPress, Joomla or another application, or one of its plugins or themes. Stolen passwords are the second most common cause. Our servers are kept updated and protected, but we can't update the software inside your website for you.

Step 1: Find out what was changed

• Run a scan. See Scan your website for malware.
• In cPanel, open Imunify360 (under Security) to see files it has already found and cleaned. See Imunify360 website protection.
• In File Manager, sort your website's folder by date to see recently changed files.

Step 2: Restore a clean copy

The quickest fix is often to restore your website from a backup taken before the hack. We back up your account every day. See Restore files, databases and email with JetBackup.

Choose a backup from before the problem started, and restore your website's files and its database. Make sure you also complete the next steps, otherwise the attacker can get in the same way again.

If you don't have a clean backup, remove the infected files and replace the application's own files with fresh copies from its official website. Keep your own content, such as uploads, and your configuration file.

Step 3: Close the hole

• Update everything: the application (WordPress, Joomla and so on), and every plugin, extension and theme.
• Delete what you don't use: old plugins, themes, test copies of the site and old installations in other folders. Even inactive plugins can be exploited.
• Check for unknown admin users in your website's admin area, and remove them.

Step 4: Change your passwords

Change every password connected to the website, using strong, unique passwords:

• your website's admin users;
• cPanel, FTP accounts and email accounts;
• the database user, and update it in your website's configuration file (for WordPress, wp-config.php);
• the Client Area.

Turn on two-factor authentication for cPanel and the Client Area. See Secure your Client Area account.

Step 5: Check your computer

Passwords are sometimes stolen by malware on the computer used to manage the website. Run an up-to-date antivirus scan on it.

Step 6: Tell Google, if needed

If Google shows a warning for your site, check it in Google Search Console under Security issues, and request a review once the site is clean.

Stay protected

See Secure your WordPress or Joomla website for ways to keep your website safe from now on.

If you need help, please open a support ticket in the Technical Support department.