# I received a security alert. What should I do?

> What to do when Ruachost emails you about malware found on your website or a password change on your account, and how to tell a real alert from a scam.

Source: https://helpcenter.ruachost.com/ssl-security/website-security/i-received-a-security-alert/

Ruachost sends security alerts by email for two things:

- **Malware found** on your website.
- **Password changed** on your account.

First, check the alert is real, then follow the steps for that alert below.

## Is the alert real?

Scammers send fake "security alerts" to trick people into giving away passwords or paying fake invoices. A real alert from us:

- Comes **only from a Ruachost domain**: an address ending in `@ruachost.com`. An alert from any other domain, such as a Gmail address or a look-alike domain, isn't from us. See [Official Ruachost emails and websites](https://helpcenter.ruachost.com/getting-started/guides/official-ruachost-emails-and-websites/).
- **Never asks for your password**, card details or a payment to "unlock" your account.
- Links only to `ruachost.com`, `dashboard.ruachost.com` or your own cPanel.

If you're not sure, don't click any links. Log in to the [client area](https://dashboard.ruachost.com/clientarea.php) by typing the address yourself, or [contact support](https://helpcenter.ruachost.com/getting-started/guides/contact-support/) and ask. See [Protecting yourself from email phishing scams](https://helpcenter.ruachost.com/ssl-security/website-security/protecting-yourself-from-email-phishing-scam-attempts/).

## Malware found on your website

Our security tools, **Imunify360** and **Monarx**, found malicious code in your website's files. They often block or clean it automatically, but you still need to check your site and close the hole the attacker used.

1. **Look at what was found.** In cPanel, open **Imunify360** and **Monarx Security** under **Security** to see which files were flagged and what was done. See [Scanning for malware with Imunify360 and Monarx](https://helpcenter.ruachost.com/ssl-security/website-security/scanning-for-malware-with-imunify360-and-monarx/).
2. **Clean the remaining files.** Use **Cleanup** in Imunify360, or replace the files with clean copies. For WordPress, see [Restoring WordPress core files](https://helpcenter.ruachost.com/wordpress/guides/restoring-wordpress-core-files/).
3. **Update everything.** Update your CMS, plugins and themes, and delete any you don't use. Old, unpatched plugins are the most common way in.
4. **Change your passwords.** Change your cPanel, website admin, FTP and database passwords. Check for admin users you don't recognise.
5. **Scan again** to confirm nothing is left.

If your site was showing spam or redirecting visitors, see [Cleaning up an SEO spam hack](https://helpcenter.ruachost.com/ssl-security/website-security/cleaning-up-an-seo-spam-hack/) and [Repairing and securing a hacked site](https://helpcenter.ruachost.com/ssl-security/website-security/repairing-and-securing-a-hacked-site/).

You're responsible for cleaning your website, but our support team is happy to help you understand what was found and what to do next. Our backups can also help: see [Restoring files, email and databases using JetBackup](https://helpcenter.ruachost.com/cpanel/files/restoring-files-email-and-databases-using-jetbackup/).

## Password changed

You'll get this email whenever the password for your client area or hosting account changes.

**If you changed it:** there's nothing to do.

**If you didn't change it**, act straight away:

1. **Reset your password** from the [client area login page](https://dashboard.ruachost.com/clientarea.php) (click **Forgot password?**). See [Changing or resetting your client area password](https://helpcenter.ruachost.com/getting-started/client-area/changing-or-resetting-your-client-area-password/).
2. **Secure your email inbox.** Whoever changed your password may have access to the email address on your account. Change that email password too.
3. **Turn on two-factor authentication** for your client area. See [Activating two-factor authentication](https://helpcenter.ruachost.com/getting-started/client-area/how-to-activate-two-factor-authentication-2fa-on-your-ruachost-account/).
4. **Check your account** for changes you didn't make: contact details, users with access, new orders or services.
5. [Contact support](https://helpcenter.ruachost.com/getting-started/guides/contact-support/) and tell us what happened, so we can check your account with you.

## Related articles

- [Creating a strong password](https://helpcenter.ruachost.com/ssl-security/website-security/creating-a-strong-password/)
- [Reporting a security issue](https://helpcenter.ruachost.com/getting-started/guides/reporting-a-security-issue/)