Sadly, when runningyour own website there is always the possibility of getting hacked.We are aware how stressful this is and the negative impact it canhave on your business. In this article, we will provide you with astep-by-step guide on what to do if you fall victim to hackers.
First andforemost, don’t panic! Contact a professional.
Your online securityis a very serious matter, especially if your business and reputationare depending on it. This is why we recommend that the first thingyou do is stay calm and get in touch with a professional to check theproblem for you, sites have been hacked before, it’s not the end ofthe world. Our Fixed team has plenty of experience with hackedwebsites and we are excellent at locating and fixing such issues in afast and efficient way.
Maintenance Mode
If you decide tohandle the matter yourself and you are confident in your own skills,then this is what you need to do. You don’t want visitors seeingthe state of your site while you are trying to fix it.
If you can, put itinto maintenance mode.
If logging into yoursite is not something you can do at the moment, do it as soon aspossible. Once this is done you can relax knowing people will not beaware what’s going on with your website.
Reset allpasswords
As you are not surewhich is the hacked password used to gain access to your website,just to be on the safe side change all of them. This will prevent thehacker from using them. Change the password to your database, hostingprovider and SFTP password as well.
All admins to yoursite need to reset their passwords.
Update Themes andPlugins
The next importantstep is to check if all themes and plugins are up to date. Go toDashboard – Updates and update everything outdated on your website.
Do this beforeattempting other fixes, because if your theme or plugins make yoursite vulnerable, other fixes you make could be undone by thisvulnerability. Before you proceed make sure everything is up to date.
Remove users
If you see adminaccounts to your website which were not there before, you need toremove them. Check with other admins if they have made any changes totheir details and if there aren’t any, delete the unknown accounts.
Remove unwantedfiles
Use a securityplugin to scan your website and see if there are any files thatshouldn’t be there. The one we recommend is called Cerber – itdoes regular file integrity checks and it’s super useful.
Clean out yoursitemap and Resubmit to Google
Search engines canred-flag your website because of sitemap.xml file. You need toregenerate your sitemap with the help of an SEO plugin like YOAST.You need to notify Google that your site is now clean. Add your siteto Google Search Console and submit a sitemap report telling Googleyou wish your site to be crawled. Be advised the process can take upto two weeks, so be patient.
Reinstall Themesand Plugins
If you are stillfacing problems with your site, all themes and plugins which are notupdated need to be reinstalled. Go to the Themes and Plugins pagesand reinstall them. If your site is not on maintenance mode, do thatfirst.
If you bought thetheme or plugin from a vendor and you are not sure it’s secureenough, it’s a good time to consider whether you should be usingit. If you installed a free plugin or theme from a different placeother than the WordPress theme or plugin directories, don’treinstall it. Instead buy the legitimate version or install it fromthe theme or plugin directory. If you can’t afford it, simplyreplace it with a free version which does a similar job.
ReinstallWordPress Core
If all other optionsfail, reinstall WordPress. If your files have been compromised, youneed to replace them with a clean WordPress Installation. Upload your newWordPress files via SFTP, overwriting the old ones. It’s good totake a backup of your .htaccess and wp-config.php files if they areoverwritten.
Clean out yourDatabase
If your database washacked, you need to clean it as well. A clean database will havefewer stale data taking up space, which will make your site runfaster. How do you know ifyour site’s database has been hacked? Use your security plugin torun a scan, which will tell you if your database was compromised.
Was this articleuseful? Share your tips and comments bellow.
