A redirect to a casino, emails to customers “from you,” a miner eating up the CPU, or simply “the site won’t load” — the signs are always the same. The key in the first hour: don’t erase the traces and don’t restore things “as they were.”
The first hour
- Take a server snapshot before doing anything else — it’s both evidence and insurance.
- Isolate: put up a maintenance page (nginx
return 503), disable outgoing mail, change SSH/panel/database passwords. - Find the entry point. Check the web server logs for the past few days: POST requests to odd files (
wp-content/uploads/*.php,.well-known/*.php), requests toxmlrpc.php, admin logins from unfamiliar IPs.find . -mtime -7 -name "*.php"will show recently modified files. - Don’t clean it in place. Deleted “virus files” will come back through a backdoor you didn’t find.
Recovery
- Deploy a clean server and restore the site from a backup made before the hack. If you don’t know when it happened, use a backup older than the oldest suspicious file.
- Check the database for injections: in WordPress, the
wp_optionstable (siteurl, scripts),wp_users(extra administrators), posts containing<script>. - Change all passwords: admin panel, database, FTP, payment system API keys, SMTP.
- If spam was sent from the server, check the IP against blacklists (mxtoolbox) and request delisting.
How sites are most often hacked
| Cause | Share | Protection |
|---|---|---|
| Outdated plugin/theme/CMS | ~50% | automatic updates, removing unused components |
| Weak administrator password | ~20% | 2FA, login attempt limits |
| Pirated themes and plugins with backdoors | ~10% | official sources only |
| Open ports, old PHP | ~10% | firewall, supported versions |
| Neighbors on shared hosting | ~10% | VPS with isolation |
Seven measures to prevent a repeat
- Automatic security updates for the OS and CMS.
- Two-factor authentication for the admin panel and key-based SSH.
- Firewall: only 80, 443 and SSH from your IPs are open.
- Block PHP execution in upload folders.
- Backups to separate storage with 30-day retention — and restore testing.
- Monitoring: file changes, load, external checks of page content.
- Minimal plugins, and not a single “nulled” one.
If you need help
As part of MyCloud server administration, we investigate the breach, restore the site on a clean server and close the entry point — usually within a few hours. Clients with backups at MyCloud can restore in one click from the panel.
Need help with the task from this article?
We’ll pick a configuration, calculate the cost and help with the move.