How do you know if your website has been hacked?
A hacked site is most often spotted through behaviour you did not program.
- Unknown pages in Google, often in a foreign language or about unrelated products
- A redirect to another site, sometimes only on phones or when coming from Google
- A “dangerous site” warning in the browser or in search results
- Administrator accounts you did not create
- A host reporting mass email sending or suspending the account
- A site that is suddenly very slow, or files recently changed for no reason
Some hacks are invisible to you and only show to visitors coming from Google. Check from another device.
What should you do in the first hour?
In the first hour, the goal is to cut off the attacker's access and preserve the traces.
Change every password from a clean device: hosting, site administration, database, FTP, the email linked to the domain. Delete unknown administrator accounts. Put the site in maintenance mode if visitors are being redirected or if customer data is at stake.
Before deleting anything, make a full copy of the files, the database and the server logs. It helps you understand how the attacker got in. Tell your host: they often have useful information.
A question about your case? We answer on WhatsApp, with no commitment.
Request a quoteHow do you clean a hacked website?
The safest clean-up is to start again from a clean base rather than hunting for each infected file by hand.
If you have a backup from before the hack, restore it, then reapply the changes made since. Otherwise, reinstall the site core and plugins from their official sources, then compare the remaining files with a clean version. Check the database: attackers often hide code or links in it.
Cleaning is useless if the hole stays open. You need to find the entry point: an outdated plugin, a weak password, a poorly protected form, a badly configured server. Without this step, the site is often hacked again within days.
Why are WordPress sites targeted so often?
WordPress is targeted mainly because it is so widespread, which lets attackers hit thousands of sites with the same automated tool.
The WordPress core is closely watched. The risk most often comes from plugins and themes that are not updated, or from pirated versions of paid themes downloaded from dubious sites, which sometimes already contain malicious code.
A custom site is not immune either: a poorly protected form or a server that is never updated are also ways in. What protects you is regular upkeep, whatever the tool.
How do you stop a hack from happening again?
A handful of habits is enough to keep out the vast majority of automated attacks.
- Regular updates of the site, plugins and server
- Removal of unused plugins and themes
- Unique passwords and two-factor authentication for administration
- Automatic backups, stored somewhere other than the server, and tested
- Separate accounts for each person, with only the rights they need
- Monitoring: an alert if the site changes or goes down
A maintenance contract covers these points for you if nobody in-house has time to deal with them.