This guide explains how to secure your web site after it has been hacked, and how to help prevent future attacks.
Determining the cause
The first step to securing your web site and getting back to normal operation is determining how it was hacked. In general, most hacks occur for one of the following reasons:
Your FTP password has been compromised.
File permissions for files or directories in the public_html directory are too permissive.
You have a software application installed on your web site that contains a vulnerability. The vulnerability is being exploited to run arbitrary code on the server.
Software vulnerability hacks are more common than FTP/SSH password hacks, primarily because of the huge growth in pre-bundled software applications. Users often set up an application and then forget to apply security updates, leaving their sites vulnerable to attack.
Similarly, if a file or directory in the public_html directory has permissions set to 777 (full access), code or data may be exposed and potentially exploited by an attacker.
Looking for FTP password compromises
Change your account password in cPanel immediately.
Stop using FTP. Regular FTP transmits your password over the Internet in unencrypted plaintext and is easily intercepted. Use SFTP or SSH instead. For information about how to do this, please see these articles.
Verify that you are running up-to-date virus and malware protection on any computers you have used to access your account.
After you have followed these steps, go to the Cleaning up after a hack section below. Otherwise, if you did not find any suspicious behavior, go to the next section.
Looking for software vulnerabilities
Out-of-date software applications often contain well-known security vulnerabilities that malicious actors can exploit using automated scripts. Software applications include anything you have installed using Softaculous, as well as any packages that you have installed manually. Usually these are applications such as blogs, image galleries, forums, shopping carts, content management systems, etc.
You should review all of the software applications that are installed on your web site. Make sure you have installed the most recent version and all updates. When you update software applications, make sure you check the plugins as well. If you have any non-standard plugins installed with your applications, do a web search for the plugin name and the term “vulnerability” to see if there are any known issues with your version. If you discover any known vulnerabilities, either update the plugin or disable it.
You should also check for recent errors on your web site by using cPanel’s Error Log feature. Error messages can help you determine which software applications or files are vulnerable. For more information about how to access the error log in cPanel, please see this article.
After you have updated your software applications and plugins, go to the Cleaning up after a hack section below.
Cleaning up after a hack
After you have secured your web site, the next step is to clean up the mess left behind by the perpetrators and restore normal operation.
Removing hacked files
You should go through all of the files in your account and delete anything that you did not put there. If you are using an FTP client, make sure it is set to show hidden files. Similarly, if you are using the command line in SSH, make sure you use the -a option with the ls command so it shows all files. (Many malicious files try to “hide” from casual observation by making themselves hidden.)
Although we recommend going through all of your files, you can prioritize your search. Look first for file modification timestamps that have changed since you last modified your site, or that occurred around the time the hack took place. If you identify a file that was modified during the hack (such as a defaced index page), you may be able to locate other affected files by searching for similar timestamps.
Setting correct file permissions
By default, every directory beneath the public_html directory should have its file permissions set to 755 (full access for the owner, and read and execute access for everyone else). Additionally, every file should have its permissions set to 644 (read and write access for the owner, and read access for everyone else).
After you make these changes, you may need to adjust permissions for a few individual files, depending on the applications you have installed. Nevertheless, it is a good security practice to set secure permissions initially, and then make any individual adjustments as necessary.
Restoring databases
Some hacks, particularly SQL injection attacks against vulnerable Joomla! installations, may alter the database with malicious code. These modifications can grant an attacker access to your account even after you update applications and remove altered files.
Therefore, you should review your databases to see if there are any suspicious changes. You may also want to restore the database from a backup that was completed before the attack occurred.
Restoring lost and modified files
You can use the Server Rewind feature in cPanel to restore files in your home directory that have been lost or modified within the past month.
Re configuring WordPress
If you use WordPress, there are additional steps you must take to secure your site after an attack. For example, you must reset the WordPress security keys.
