View Categories

Clean up a hacked site

If your site shows pages you didn’t make, sends visitors somewhere else, or has files you don’t recognize, work through these steps in order. You can do most of them in your control panel.

Before you start #

  • Open your control panel. See How to open your control panel.
  • Work out roughly when the problem started. You will pick a backup from before that date.
  • Backups are kept for 30 days. If the problem started earlier than that, open a ticket from Get Help before you restore.

Step 1: Save a copy of the site as it is now #

A restore replaces what is there now. Save a copy first, in case you need something from it later.

  1. Open Websites and select your site.
  2. Open the Backups tab.
  3. Select Backup now.

Step 2: Restore a clean backup #

  1. On the Backups tab, find a backup from before the problem started. Each row shows the date and time it was made.
  2. Open its Restore menu and choose Custom.
  3. Use the Files and Databases tabs to choose what to restore. Leave Emails alone unless your mail was affected.
  4. Select Restore now.

You can’t restore a single file. Files are restored all together or not at all. See Back up and restore your site.

After the restore, look through your site’s files. If you see files or folders in public_html that you don’t recognize, open a ticket from Get Help before you delete anything.

Step 3: Change every password #

Change these in this order. See Reset a password for your account, email or database for each one.

  1. Your Get Simple account. Your control panel opens from this account, so protect it first.
  2. Your WordPress or Joomla admin. Change it from your site’s admin, and remove any admin users you don’t recognize.
  3. Your database user. Open Databases, then the Users tab, then the three-dot menu next to the user, then Manage. Next to Password, select Reset, enter a New password and select Change password. Then put the new password in your app’s settings (for WordPress, wp-config.php; for Joomla, configuration.php).
  4. Your FTP accounts. Open Advanced, then FTP. On each row, open the three-dot menu and select Manage. Next to Password, select Reset, enter a New password and select Save. Delete any account you don’t use with Delete on the row’s three-dot menu.
  5. Your mailboxes, if your site’s contact forms or mail were affected.

Step 4: Turn on two-factor authentication #

Turn it on for your Get Simple account. See Turn on two-factor authentication for your Get Simple account.

Step 5: Update everything #

  1. Update WordPress or Joomla to the latest version.
  2. Update every plugin, extension and theme.
  3. Remove plugins and extensions you don’t use.

A restored backup puts back the versions you had then. If those were out of date, update them again right away.

Still seeing problems? #

Open a ticket from Get Help. Tell us the site, when the problem started, and which backup you restored.

FAQ #

Should I restore before or after changing passwords? #

Restore first, then change passwords. If your site can’t connect to its database after a restore, open a ticket from Get Help.

Can I restore just the infected files? #

No. Files are restored all together or not at all.

My backup list doesn’t go back far enough. What now? #

Backups are kept for 30 days. Open a ticket with the site and the date you need, and we will tell you what is available.

Related #