When your WordPress website is hacked, the browsers will start issuing red alerts to you or any visitor visiting the website. Before you know it, your hosting provider will pull down your website for being hacked. The Google search results will start flagging your website as hacked or malicious. Being the latest victim of the ever-aggressive hackers is not a fancy thing. Small businesses usually suffer from about 43% of online malicious campaigns. Do you know that hackers are performing a cyber attack on a website somewhere after every 39 seconds? Such companies end up experiencing losses in revenue and reputation. However, before you throw in the towel and exit the online business, you should know that solutions to these menaces are there. We have prepared this post to help you address this problem once it arises. If your WordPress website is hacked, you should be on your feet again after following these steps.
Immediate Steps To Take If Your Website Has Been Hacked
1. Confirm the hack
Have you set up Google Search Console for your website? Make sure you have done so. Additionally, enable email alerts to notify you immediately if it detects malicious software on your site. Always visit the Security Issues panel. If you find a warning appearing as below, it means your website is hacked.
As a website owner, having a good malware scanner is crucial. You can use the on-demand malware scanner. The automatic real-time scans will alert you in case of any malware on your website.
When your website is hacked, visitors may encounter the following warning messages and notifications:
2. Change passwords
Have you found out that the website has been hacked? Rush and change your passwords. Ensure they are hard-to-guess. Inform all users to also do so from their end.
Depending on the type of your hosting, ensure you have changed passwords for Primary FTP, secondary FTP, databases, MySQL databases, and MS SQL databases.
3. Back up
It is recommendable to have a website backup to allow you to backup your website via FTP or SFTP. Ensure to configure the backup for your website. Some hosting companies like GoDaddy, Hostinger, Kinsta will do this for you automatically.
It allows the backup of your databases and files depending on the frequency you choose, i.e., daily, weekly, or monthly.
4. Restore a backup
Do you have your website’s uncorrupted backup? You need to re-upload it to your hosting account.
Restoring your site from backups depends on the way you created the backups. For example, if you used a plugin such as BackupBuddy or Updraft to create backups, you need to restore using the same plugin. Similarly, reset your website manually if you used manual backups.
5. Quarantine your site
You can take your website offline to allow you to complete the cleanup exercise with no interference from hackers. It also protects legit users from malicious files and codes.
6. Assess the damage
You can contact your hosting provider to get a review of the extent of the damage. Additionally, you can visit the Security Issues panel of your Google Search Console to assess the damage.
7. Clean and maintain your site
You should replace the files with new files or uninfected backup. If your database has malware, remove it using special tools like Search Replace-DB or Adminer. Don’t stop there. Hackers always leave a doorway to return to your website. Find and seal these doors. You should perform all these steps to stay safe.
Remove any unfamiliar user account on your website. Additionally, it is recommendable to assign only one admin role and allow only limited privileges to the other users.
You should also update your website software and reset configuration settings. Outdated websites and plugins usually have a lot of vulnerabilities.
8. Identify the vulnerability and patch it
Find out how the hackers managed to get your website hacked. Passwords and structural weaknesses are the two principal vulnerabilities of websites.
Most websites are hacked because the hackers could guess the passwords using brute force. You can prevent future attacks of these nature by changing your passwords into stronger ones.
You should also carry out thorough testing to identify structural weaknesses. Make sure to use reliable security software to do this scanning.
9. Request a review
Did web spam authorities like Google, Yandex, and McAfee blacklist your website due to security threats? After fixing the issues, go ahead and request them to review the site.
- Ask your hosting company to remove the suspension if they had placed it.
- For each blacklisting authority, provide the requested information for review.
Conclusion
When your website gets hacked, the hackers may do huge damages that can cost your business a lot of money. The good news is that with the right steps, you can halt their actions before they go further. Always be vigilant and follow these steps at all times. You can also employ the security solution & follow the the best WordPress security practices keeping your WordPress secure 24/7. It will ensure your website is not hacked again.
Learn more about how to get wordpress hosting discount.
