I received a security alert. What should I do?

Ruachost sends security alerts by email for two things:

• Malware found on your website.
• Password changed on your account.

First, check the alert is real, then follow the steps for that alert below.

Is the alert real?

Scammers send fake “security alerts” to trick people into giving away passwords or paying fake invoices. A real alert from us:

• Comes only from a Ruachost domain: an address ending in @ruachost.com. An alert from any other domain, such as a Gmail address or a look-alike domain, isn’t from us. See Official Ruachost emails and websites.
• Never asks for your password, card details or a payment to “unlock” your account.
• Links only to ruachost.com, dashboard.ruachost.com or your own cPanel.

If you’re not sure, don’t click any links. Log in to the client area by typing the address yourself, or contact support and ask. See Protecting yourself from email phishing scams.

Malware found on your website

Our security tools, Imunify360 and Monarx, found malicious code in your website’s files. They often block or clean it automatically, but you still need to check your site and close the hole the attacker used.

1. Look at what was found. In cPanel, open Imunify360 and Monarx Security under Security to see which files were flagged and what was done. See Scanning for malware with Imunify360 and Monarx.
2. Clean the remaining files. Use Cleanup in Imunify360, or replace the files with clean copies. For WordPress, see Restoring WordPress core files.
3. Update everything. Update your CMS, plugins and themes, and delete any you don’t use. Old, unpatched plugins are the most common way in.
4. Change your passwords. Change your cPanel, website admin, FTP and database passwords. Check for admin users you don’t recognise.
5. Scan again to confirm nothing is left.

If your site was showing spam or redirecting visitors, see Cleaning up an SEO spam hack and Repairing and securing a hacked site.

You’re responsible for cleaning your website, but our support team is happy to help you understand what was found and what to do next. Our backups can also help: see Restoring files, email and databases using JetBackup.

Password changed

You’ll get this email whenever the password for your client area or hosting account changes.

If you changed it: there’s nothing to do.

If you didn’t change it, act straight away:

1. Reset your password from the client area login page (click Forgot password?). See Changing or resetting your client area password.
2. Secure your email inbox. Whoever changed your password may have access to the email address on your account. Change that email password too.
3. Turn on two-factor authentication for your client area. See Activating two-factor authentication.
4. Check your account for changes you didn’t make: contact details, users with access, new orders or services.
5. Contact support and tell us what happened, so we can check your account with you.

Related articles

• Creating a strong password
• Reporting a security issue