How to fix website hacked what to do troubleshoot: Comparison and Best Practices

Recognizing a Website Compromise

Accurate diagnosis separates actual security incidents from false positives. Common indicators include unexpected redirects to unfamiliar domains, new administrative users you did not create, modified core files with recent timestamps, and search engine warnings about malware or phishing content.

Server-side symptoms manifest as unusual CPU or bandwidth spikes, unfamiliar cron jobs, outbound SMTP connections you did not authorize, and file permission changes that grant write access where it should not exist. Visitor complaints about pop-ups, spam, or antivirus warnings confirm client-side payload delivery.

Differentiate between compromises and false positives by checking multiple indicators. A single modified file could be a legitimate update. Multiple unauthorized changes, especially in core CMS files combined with new database users or scheduled tasks, strongly indicate compromise. Search console security warnings from Google carry high reliability when they appear.

Immediate Containment: Comparing Response Options

Choose containment level based on compromise severity and business impact. Payment processing sites, membership platforms, and high-traffic content sites should default to full offline mode until you confirm no active data theft. Brochure sites with SEO spam can use maintenance mode. Development or staging sites may only need firewall isolation.

Document your containment decision with timestamps and reasoning. This creates an incident timeline useful for identifying entry points and demonstrates due diligence if you need to report the breach to customers or authorities.

• **Full offline mode**: Disable the web server or remove DNS records to completely block access. Use this when malware actively exploits visitors, when the site serves phishing content, or when you detect ongoing unauthorized access. Downtime is total but exposure stops immediately. Suitable for sites where security risk outweighs revenue loss during investigation.
• **Maintenance mode**: Display a static holding page while keeping the application offline. Maintains brand presence and communicates status to visitors. Use this for confirmed compromises where malware does not actively exploit visitors, such as defacement or SEO spam injection. Requires trusted maintenance mode plugins or server-level implementation to avoid serving infected code.
• **Firewall isolation**: Block all traffic except your IP using firewall rules (iptables, cloud security groups, or hosting control panel IP allow lists). Preserves full functionality for investigation and testing without exposing visitors. Best for scenarios where you need to trace attack vectors, test fixes iteratively, or maintain critical backend processes while investigating.

Cleanup Method Comparison: Backup Restoration vs Manual Removal

Backup restoration wins for speed and completeness when prerequisites exist—verified clean backups and acceptable data loss window. Manual removal becomes necessary when backups are unavailable, compromised, or too old relative to recent business-critical updates.

Security scanners augment but do not replace manual analysis. Automated tools detect known signatures but miss zero-day malware or heavily obfuscated code. Use scanners as a starting point, then manually review flagged files and check commonly targeted locations—wp-config.php, .htaccess, theme functions.php, and plugin directories for WordPress; index.php, configuration.php, and templates for Joomla; index.php and admin directories for Magento.

• **Backup restoration**: Fastest recovery path when you have verified clean backups from before the compromise. Full restore to a clean environment (new server instance or reformatted hosting account) eliminates all malware instantly. Trade-off: loses any legitimate content or data added after the backup date. Requires backup verification—scan the backup files with updated antivirus before restoring to confirm they predate the compromise. Best for: sites with daily automated backups, compromises detected within days, and tolerance for losing recent changes.
• **Manual malware removal**: Identify infected files using security scanners (Wordfence, Sucuri SiteCheck, clamav), compare file hashes against official distributions, and search for known malware signatures. Remove malicious code while preserving legitimate files and recent changes. Trade-off: time-intensive, requires technical skill to distinguish malware from legitimate code, and risks incomplete removal if rootkits hide processes. Best for: sites without recent backups, need to preserve content added after the last backup, or when investigating attack vectors for security improvement.
• **Hybrid approach**: Restore core application files from clean sources (fresh WordPress download, official plugin repository versions) while manually reviewing custom themes, uploaded media, and database contents. Balances speed with thoroughness. Trade-off: requires identifying which components are custom versus standard, and database malware still needs manual review. Best for: CMS-based sites where you can definitively separate core files from custom code.

Database Cleanup and Verification

File system cleanup alone is insufficient. Attackers frequently inject malware into database records—admin users, post content, widget areas, option tables, and scheduled events. Database compromise allows reinfection even after cleaning all files.

Export the database and search for suspicious patterns using command-line tools or phpMyAdmin. Look for base64-encoded strings in post content, unfamiliar administrator accounts, scheduled tasks that execute eval() or system() functions, and JavaScript injection in widgets or theme options. WordPress-specific targets include wp_users (rogue admins), wp_options (malicious cron hooks), and wp_posts (injected content).

Compare current admin users against documented legitimate accounts. Remove any unauthorized users, then force password resets for all remaining accounts. Check user roles—attackers sometimes elevate subscriber accounts to administrator rather than creating obvious new users.

After removing malicious database entries, verify application behavior by testing key workflows—admin login, content display, form submissions, and plugin functions. Database malware sometimes breaks functionality when removed if the attacker modified application logic to depend on injected code.

Post-Recovery Hardening to Prevent Reinfection

Cleaning a compromised site without addressing the entry point guarantees reinfection. Hardening closes vulnerabilities and adds detection layers that catch future attempts before they succeed.

Update all software immediately—CMS core, plugins, themes, and server software (PHP, web server, database). Most compromises exploit known vulnerabilities with public exploits. Check your CMS security advisories to identify which vulnerability likely allowed entry, then verify the update patches that specific issue.

Change all credentials—hosting control panel, FTP/SFTP, database, CMS admin accounts, and any API keys or third-party service passwords stored in configuration files. Attackers who gained access once may have harvested credentials for persistent access. Use unique strong passwords generated and stored in a password manager.

Implement file integrity monitoring with tools like AIDE, Tripwire, or CMS-specific plugins that alert when core files change. This creates early warning for future compromise attempts. Configure alerts to email or messaging platforms you check regularly.

• **Web Application Firewall (WAF)**: Cloud-based WAF services (Cloudflare, Sucuri, AWS WAF) filter malicious requests before they reach your server. Blocks common exploit attempts, brute force login attacks, and known bad actors. Trade-off: adds latency and monthly cost, but dramatically reduces attack surface.
• **Two-factor authentication (2FA)**: Require 2FA for all administrative accounts using authenticator apps or hardware tokens. Prevents credential-based compromises even if passwords leak. Nearly all modern CMS platforms support 2FA through core features or plugins.
• **Principle of least privilege**: Remove write permissions from directories that should only serve static content. Set file permissions to 644 for files and 755 for directories in most cases. Disable PHP execution in upload directories using .htaccess rules or web server configuration.
• **Security headers**: Implement Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options headers to limit cross-site scripting and clickjacking attacks. Configure these in your web server configuration or through security plugins.
• **Regular backup automation**: Configure automated daily backups stored off-server with retention periods matching your recovery time objectives. Test restoration quarterly to verify backup integrity and procedure accuracy.

When to Use Professional Incident Response Services

Professional security services deliver value when downtime costs exceed their fees, when you lack technical expertise for confident manual cleanup, or when evidence preservation matters for legal or compliance reasons.

E-commerce sites, membership platforms, and high-traffic publishers should consider professional help when compromise impacts revenue or customer data. Services like Sucuri, Wordfence Premium incident response, or specialized security firms provide guaranteed cleanup within SLA timeframes (often 24-48 hours), malware removal warranties, and forensic reports identifying attack vectors.

DIY cleanup makes sense for low-traffic sites with good backups, technical site owners comfortable with command-line tools and code review, and situations where learning the recovery process provides long-term value for your operations.

Balance cost against opportunity cost—if investigation and cleanup take you away from revenue-generating work for multiple days, professional service may cost less than your time. For hosting support engineers, DIY develops incident response skills valuable across customer support scenarios.