Repairing and securing a hacked site

If your website has been hacked despite your best efforts, it’s critical to act quickly. This guide explains how to secure your site, clean up malicious changes, and prevent future attacks.

Step 1: Determine the Cause

Most hacks occur due to:

Compromised FTP/SSH passwords → Attackers gain direct access.
Overly permissive file permissions → Files/directories set to 777 can be exploited.
Software vulnerabilities → Outdated CMS, plugins, or applications leave openings for attackers.

Always check for outdated software and insecure plugins first.

Step 2: Look for Password Compromises

Log in via SSH and review recent commands:
Terminal window
```
history
```
Check the last login IP:
Terminal window
```
cat ~/.lastlogin
```
If suspicious, change all account passwords immediately.
Stop using plain FTP — switch to SFTP or SSH.

Step 3: Check for Software Vulnerabilities

Update all applications (WordPress, Joomla, plugins, themes, etc.).
Search for known plugin vulnerabilities online.
Disable or remove insecure plugins.
Review error logs in cPanel for clues.

Step 4: Clean Up After a Hack

Stop Malicious Processes

List running processes:
Terminal window
```
ps faux
```
Kill suspicious processes:
Terminal window
```
kill process_id
```

Remove Hacked Files

Show hidden files in FTP or SSH (ls -a).
Search for recently modified files:
Terminal window
```
find . -mtime -3
```
Delete files you didn’t create.

Reset File Permissions

Directories → 755

Files → 644

find . -type d -exec chmod -c 755 {} \;
find . -type f -exec chmod -c 644 {} \;

Restore Databases

Check for malicious SQL injections.
Restore from a clean backup if needed.

Restore Lost/Modified Files

Use Server Rewind in cPanel to recover files from the past month.

Step 5: Reconfigure WordPress (if applicable)

Reset WordPress security keys in wp-config.php.
Update all plugins/themes.
Harden login security (limit attempts, enable reCAPTCHA).

Step 6: Request a Google Review

After cleanup, request Google to review your site in Search Console.
Once verified safe, Google will remove the “Deceptive Site Ahead” warning.

Step 7: Prevent Future Attacks

Enable Cloudflare for DDoS protection and bot filtering.
Keep software updated.
Use strong passwords and SSH keys.
Monitor logs regularly.