# Repairing and securing a hacked site

> Find out how your site was hacked, remove malicious changes, reset passwords and harden the site against future attacks.

Source: https://helpcenter.ruachost.com/ssl-security/website-security/repairing-and-securing-a-hacked-site/

If your website has been hacked despite your best efforts, it’s critical to act quickly. This guide explains how to secure your site, clean up malicious changes, and prevent future attacks.

## Step 1: Determine the Cause

Most hacks occur due to:

- **Compromised FTP/SSH passwords** → Attackers gain direct access.
- **Overly permissive file permissions** → Files/directories set to `777` can be exploited.
- **Software vulnerabilities** → Outdated CMS, plugins, or applications leave openings for attackers.

Always check for outdated software and insecure plugins first.

## Step 2: Look for Password Compromises

- Log in via SSH and review recent commands:

  ```bash
  history
  ```
- Check the last login IP:

  ```bash
  cat ~/.lastlogin
  ```
- If suspicious, **change all account passwords immediately**.
- Stop using plain FTP — switch to **SFTP or SSH**.

## Step 3: Check for Software Vulnerabilities

- Update all applications (WordPress, Joomla, plugins, themes, etc.).
- Search for known plugin vulnerabilities online.
- Disable or remove insecure plugins.
- Review error logs in cPanel for clues.

## Step 4: Clean Up After a Hack

### Stop Malicious Processes

- List running processes:

  ```bash
  ps faux
  ```
- Kill suspicious processes:

  ```bash
  kill process_id
  ```

### Remove Hacked Files

- Show hidden files in FTP or SSH (`ls -a`).
- Search for recently modified files:

  ```bash
  find . -mtime -3
  ```
- Delete files you didn’t create.

### Reset File Permissions

- Directories → `755`
- Files → `644`

  ```bash
  find . -type d -exec chmod -c 755 {} \;
  find . -type f -exec chmod -c 644 {} \;
  ```

### Restore Databases

- Check for malicious SQL injections.
- Restore from a clean backup if needed.

### Restore Lost/Modified Files

- Use **Server Rewind** in cPanel to recover files from the past month.

## Step 5: Reconfigure WordPress (if applicable)

- Reset WordPress **security keys** in `wp-config.php`.
- Update all plugins/themes.
- Harden login security (limit attempts, enable reCAPTCHA).

## Step 6: Request a Google Review

- After cleanup, request Google to review your site in **Search Console**.
- Once verified safe, Google will remove the *“Deceptive Site Ahead”* warning.

## Step 7: Prevent Future Attacks

- Enable **Cloudflare** for DDoS protection and bot filtering.
- Keep software updated.
- Use strong passwords and SSH keys.
- Monitor logs regularly.