{"id":2568,"date":"2013-11-15T18:14:47","date_gmt":"2013-11-15T18:14:47","guid":{"rendered":"http:\/\/blog.365ezone.com\/?p=2568"},"modified":"2013-11-15T18:14:47","modified_gmt":"2013-11-15T18:14:47","slug":"the-ultimate-guide-to-fixing-and-recovering-your-hacked-website","status":"publish","type":"post","link":"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/","title":{"rendered":"The Ultimate Guide to Fixing and Recovering Your Hacked Website"},"content":{"rendered":"
\n

\"fixing<\/p>\n

Having your website hacked is one of the worst feelings in the world. It can do major damage to your site\u2019s reputation, especially if Google puts a \u201cThis site may harm your computer\u201d warning on it. You aren\u2019t alone as a new website gets hacked every five seconds. There goes another one. And another. But breathe easy, 365ezone has you and your website\u2019s back. Follow these steps to fix your malware infested or hacked website.<\/p>\n

 <\/p>\n

HELP! MY WEBSITE HAS BEEN HACKED!<\/h2>\n

Find Out Exactly What Happened<\/strong><\/p>\n

The more you know about the hack, the more your host and the Internet will be able to help you. How did the hackers get in? Did this hack affect numerous sites, or were you the lone target? Was it a cPanel hack, FTP password entrance, remote file inclusion, or a code injection? Check to see if any of your data is missing, or if anything\u2019s been added to your database, like strange uploaded files you don\u2019t recognize. Once you have thoroughly checked your site, it\u2019s time to ask for help.<\/p>\n

Contact your host<\/strong><\/p>\n

Tell your host your site has been attacked and is currently down before you begin diagnosing the problem. Your host will make sure their other customers on the same server will not be compromised. They may also help find out what happened to your site and how to recover it.<\/p>\n

If you are a 365ezone client, please follow these instructions from 365ezone\u2019s Abuse Response Analyst<\/p>\n

Please open a ticket with our Abuse & Security Team and be specific on what you noticed was hacked, such as a defaced webpage, malware warnings, redirects, and so on.<\/p>\n

During this time, it is vital that you avoid making any changes to any files and\/or folders on the account so the timestamps stay in place for the investigation to proceed without delay. Look at it as a crime scene where a burglary was made, would you clean up the place before calling the police?<\/p>\n

Once the investigation is completed the Abuse & Security Team will contact you via ticket reply.<\/p><\/blockquote>\n

Search Twitter and Google for Help<\/strong><\/p>\n

If your host\u2019s support team informs you of nothing wrong with your server, it\u2019s time to reach out to the Internet for relevant answers. Twitter is filled with mostly friendly programmers and IT experts ready to help you out. Briefly explain your hack in 140 characters, with accompanying relevant hashtags. You may be lucky enough to find someone who went through the same issue you\u2019re going through.<\/p>\n

If Twitter comes up short, do a few Google searches for your hacking problem. You may stumble upon a forum discussion describing your hack or a similar one. More than 75% of forum posts on webmaster help site Badware Busters<\/a> receives a reply back.<\/p>\n

Google has also created a comprehensive section of links and videos called Webmaster Tools to help you clean up your site, prevent malware infection, and fix your hacked site. If you haven\u2019t already, sign up for Webmaster Tools<\/a>. You will need this for verification and recovery soon.<\/p>\n

Check Your User Accounts<\/strong><\/p>\n

Scan your site\u2019s users accounts to see if there\u2019s been a new user created. Delete that new account to prevent future damage from the hacker. Change the passwords for all your users and accounts. ALL YOUR PASSWORDS: FTP, database access, system administrators, and content management system accounts.<\/p>\n

Take Your Site Offline<\/strong><\/p>\n

You must take your site offline for two important reasons. One, prevent the hacker from causing further damage to your site, and two, users do not want to come to a site that gives them a scary malware alert. Stop your webserver or point your website\u2019s DNS entries to a static page on an entirely different server that uses a 503 HTTP response code. Google promises that having your site offline briefly will not affect future ranking of your site in search results. The 503 code is a useful signal that the site will be unavailable momentarily, and the signal will work because it\u2019s outside your compromised site.<\/p>\n

If you are unsure on how to take your site completely offline, again, contact your host for assistance.<\/p>\n

 <\/p>\n

GOOGLE COMES TO THE RESCUE OF YOUR HACKED SITE<\/h2>\n

Verify Ownership of Your Site<\/strong><\/p>\n

The majority of users find you site through Google, so if there\u2019s a malware label attached to your site in search, no one will be visiting you. Start the road to recovery by verifying ownership of your site. Sign into Webmaster Tools using your Google account (or create a new one). Click add a site, enter in your site\u2019s URL, and click continue. Use Google\u2019s Recommended tab or use an Alternative method.<\/p>\n

Bring your site back online if the verification method needs access to your site for a certain meta tag or file. Once you have clicked Verify, you\u2019ll see a screen mentioning you\u2019re the verified owner. You can then take your site back offline.<\/p>\n

Back in Webmaster Tools, click Manage Site, then Add or Remove Users. Determine whether the hacker already claimed ownership of your site. If there is an user you are unaware of, delete them immediately.<\/p>\n

Determine How You Were Hacked<\/strong><\/p>\n

Once Verified, the geniuses at Google will post a message in your Webmaster Tools letting you know how your site was hacked. Either spam content decreased your relevance and quality in Google\u2019s search, it was a phishing attack, or it was malware related.<\/p>\n

Fortunately, last week Google released a series of videos to help webmasters recover their site after being hacked. If the Webmaster Tools message discusses \u201csuspected hacking\u201d or \u201cphishing notification\u201d, you were hacked with spam. Read this tutorial<\/a> and watch this Google video which highlights spam techniques, how to investigate your site for spam, and how to find all the affected files.<\/p>\n

<\/center>If the Webmaster Tools message mentions \u201cinfected with malware\u201d, then the hacker could be using your site to harm visitors with malware software designed to create havoc and steal information from your computer. Read this Google tutorial<\/a> and watch the accompanying video, which discusses how to investigate the malware and finding out which files were affected.<\/p>\n

<\/center>Clean Your Server<\/strong><\/p>\n

Start by removing anything that was added by the hacker, then restore your latest backup. Install all software and program updates. Eliminate third party widgets you seldom use.<\/p>\n

Perform a clean installation on your server. Transfer good content from the backup file copy to the recently installed server. Upload only the files you know are clean.<\/p>\n

If you have newly updated clean pages, use the Fetch as Google feature<\/a> to submit pages straight to Google for crawling.<\/p>\n

Ask Google for a Review<\/strong><\/p>\n

Have you verified ownership? Have you cleaned your site of any trace of the hacker? Have you brought your clean site back online? If you answered YES to all of these questions, it\u2019s time for a Google review. Reviews are approved if Google determines your site shows no signs of being harmful to visitors.<\/p>\n

If you were a victim of phishing, complete the review here<\/a>.
\nPhishing reviews take a day or two to process, which will cause the warning to be removed from the search engine.<\/p>\n

If you were a victim of a malware attack, go into Webmaster Tools, then Heath, then Malware. Select Request Review, which will allow Google to scan your site with anti malware software. This process also takes a day or two to complete; this will remove your malware label. If the process finds malware still, the message will show you what URL\u2019s are still infected.<\/p>\n

If you were hit with spam, go to this reconsideration page<\/a>. Write a paragraph or two explaining your spam situation. Then click \u201cRequest reconsideration\u201d. Spam reviews can take a few days. Once your review is approved, the label will be removed in about 24 hours.<\/p>\n

Hopefully your site is now hack-free! Now let\u2019s make sure this doesn\u2019t happening again.<\/p>\n

 <\/p>\n

HOW TO PREVENT A FUTURE HACKING<\/h2>\n

Backup All Data and Files<\/strong><\/p>\n

Save and back up your data as often as your schedule allows. This is important because you may be able to restore your latest backup if your site goes down. If your site includes regularly visited forums, backing up your data should be done daily, so the latest posts won\u2019t disappear if a hack occurs.<\/p>\n

Stop Using Generic Usernames & Passwords<\/strong><\/p>\n

A hacker\u2019s job will be much easier if your log-in username is something like \u201cadmin\u201d, \u201cadminstrator\u201d, or \u201csite owner\u201d. Try to make your username as unique as your password. Your new password must be very hard to guess. If you can memorize the password, it\u2019s probably not secure enough. Fill your passwords up with some non-alphanumeric characters.<\/p>\n

Protect the Comment Section<\/strong><\/p>\n

Comment sections are a great relationship between owner and consumer, but it\u2019s also an easy place for hackers to invade. Validate the form input before any comment is accepted to strip out most HTML tags. WordPress has a keyword filter you can tinker with to prevent any malicious code.<\/p>\n

Update EVERYTHING<\/strong><\/p>\n

Make sure you have the most updated programs on both your hosting account and desktop. Update WordPress and Joomla to the most recent version. Flash can also cause problems on your desktop if it\u2019s not the latest update. These programs are used by millions, so it\u2019s no wonder many hackers try to hack it.<\/p>\n

Always keep an eye out for the latest fixes and releases for all active scripts. Monitor the web sites of the developers whose scripts you are running. Add their sites to your RSS feed to immediately get the bug fix patches and other tweaked releases. Don\u2019t hesitate to install these because hackers will try to exploit recently outdated scripts with confirmed security flaws.<\/p>\n

If one person on your server gets hacked or sends out harmful spam e-mail, there\u2019s a possibility all websites and data on the server become compromised. Consider upgrading to your own secure dedicated server<\/a> to prevent this potential disaster from happening again.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Having your website hacked is one of the worst feelings in the world. It can do major damage to your site\u2019s reputation, especially if Google puts a \u201cThis site may harm your computer\u201d warning on it. You aren\u2019t alone as a new website gets hacked every five seconds. There goes another one. And another. But […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[43,45],"tags":[442],"class_list":["post-2568","post","type-post","status-publish","format-standard","hentry","category-technology","category-web-hosting","tag-hacked-website"],"yoast_head":"\nThe Ultimate Guide to Fixing and Recovering Your Hacked Website - 365ezone Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Ultimate Guide to Fixing and Recovering Your Hacked Website - 365ezone Blog\" \/>\n<meta property=\"og:description\" content=\"Having your website hacked is one of the worst feelings in the world. It can do major damage to your site\u2019s reputation, especially if Google puts a \u201cThis site may harm your computer\u201d warning on it. You aren\u2019t alone as a new website gets hacked every five seconds. There goes another one. And another. But […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/\" \/>\n<meta property=\"og:site_name\" content=\"365ezone Blog\" \/>\n<meta property=\"article:published_time\" content=\"2013-11-15T18:14:47+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.hostdime.com\/blog\/wp-content\/uploads\/2013\/10\/hacker.png\" \/>\n<meta name=\"author\" content=\"Sumit Pradhan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sumit Pradhan\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/\",\"url\":\"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/\",\"name\":\"The Ultimate Guide to Fixing and Recovering Your Hacked Website - 365ezone Blog\",\"isPartOf\":{\"@id\":\"https:\/\/365ezone.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/www.hostdime.com\/blog\/wp-content\/uploads\/2013\/10\/hacker.png\",\"datePublished\":\"2013-11-15T18:14:47+00:00\",\"dateModified\":\"2013-11-15T18:14:47+00:00\",\"author\":{\"@id\":\"https:\/\/365ezone.com\/blog\/#\/schema\/person\/0d5e59d73c776f5d00287dc4274b799f\"},\"breadcrumb\":{\"@id\":\"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/#primaryimage\",\"url\":\"http:\/\/www.hostdime.com\/blog\/wp-content\/uploads\/2013\/10\/hacker.png\",\"contentUrl\":\"http:\/\/www.hostdime.com\/blog\/wp-content\/uploads\/2013\/10\/hacker.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/365ezone.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Ultimate Guide to Fixing and Recovering Your Hacked Website\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/365ezone.com\/blog\/#website\",\"url\":\"https:\/\/365ezone.com\/blog\/\",\"name\":\"365ezone Blog\",\"description\":\"Best place to get Web Hosting information\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/365ezone.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/365ezone.com\/blog\/#\/schema\/person\/0d5e59d73c776f5d00287dc4274b799f\",\"name\":\"Sumit Pradhan\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/365ezone.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/90558a964dc2d1f5a4c02bc3eeb872e3a5a0aff0a4b8a5b908094a59314a3167?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/90558a964dc2d1f5a4c02bc3eeb872e3a5a0aff0a4b8a5b908094a59314a3167?s=96&d=mm&r=g\",\"caption\":\"Sumit Pradhan\"},\"sameAs\":[\"https:\/\/365ezone.com\/\"],\"url\":\"https:\/\/365ezone.com\/blog\/author\/365ezoneadmin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Ultimate Guide to Fixing and Recovering Your Hacked Website - 365ezone Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/","og_locale":"en_US","og_type":"article","og_title":"The Ultimate Guide to Fixing and Recovering Your Hacked Website - 365ezone Blog","og_description":"Having your website hacked is one of the worst feelings in the world. It can do major damage to your site\u2019s reputation, especially if Google puts a \u201cThis site may harm your computer\u201d warning on it. You aren\u2019t alone as a new website gets hacked every five seconds. There goes another one. And another. But […]","og_url":"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/","og_site_name":"365ezone Blog","article_published_time":"2013-11-15T18:14:47+00:00","og_image":[{"url":"http:\/\/www.hostdime.com\/blog\/wp-content\/uploads\/2013\/10\/hacker.png"}],"author":"Sumit Pradhan","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Sumit Pradhan","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/","url":"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/","name":"The Ultimate Guide to Fixing and Recovering Your Hacked Website - 365ezone Blog","isPartOf":{"@id":"https:\/\/365ezone.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/#primaryimage"},"image":{"@id":"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/#primaryimage"},"thumbnailUrl":"http:\/\/www.hostdime.com\/blog\/wp-content\/uploads\/2013\/10\/hacker.png","datePublished":"2013-11-15T18:14:47+00:00","dateModified":"2013-11-15T18:14:47+00:00","author":{"@id":"https:\/\/365ezone.com\/blog\/#\/schema\/person\/0d5e59d73c776f5d00287dc4274b799f"},"breadcrumb":{"@id":"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/#primaryimage","url":"http:\/\/www.hostdime.com\/blog\/wp-content\/uploads\/2013\/10\/hacker.png","contentUrl":"http:\/\/www.hostdime.com\/blog\/wp-content\/uploads\/2013\/10\/hacker.png"},{"@type":"BreadcrumbList","@id":"https:\/\/365ezone.com\/blog\/the-ultimate-guide-to-fixing-and-recovering-your-hacked-website\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/365ezone.com\/blog\/"},{"@type":"ListItem","position":2,"name":"The Ultimate Guide to Fixing and Recovering Your Hacked Website"}]},{"@type":"WebSite","@id":"https:\/\/365ezone.com\/blog\/#website","url":"https:\/\/365ezone.com\/blog\/","name":"365ezone Blog","description":"Best place to get Web Hosting information","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/365ezone.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/365ezone.com\/blog\/#\/schema\/person\/0d5e59d73c776f5d00287dc4274b799f","name":"Sumit Pradhan","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/365ezone.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/90558a964dc2d1f5a4c02bc3eeb872e3a5a0aff0a4b8a5b908094a59314a3167?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/90558a964dc2d1f5a4c02bc3eeb872e3a5a0aff0a4b8a5b908094a59314a3167?s=96&d=mm&r=g","caption":"Sumit Pradhan"},"sameAs":["https:\/\/365ezone.com\/"],"url":"https:\/\/365ezone.com\/blog\/author\/365ezoneadmin\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/365ezone.com\/blog\/wp-json\/wp\/v2\/posts\/2568","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/365ezone.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/365ezone.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/365ezone.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/365ezone.com\/blog\/wp-json\/wp\/v2\/comments?post=2568"}],"version-history":[{"count":0,"href":"https:\/\/365ezone.com\/blog\/wp-json\/wp\/v2\/posts\/2568\/revisions"}],"wp:attachment":[{"href":"https:\/\/365ezone.com\/blog\/wp-json\/wp\/v2\/media?parent=2568"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/365ezone.com\/blog\/wp-json\/wp\/v2\/categories?post=2568"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/365ezone.com\/blog\/wp-json\/wp\/v2\/tags?post=2568"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}