# What to Do If Your Site Is Hacked

Source: https://support.kapsulehost.com/en-nz/site-hacked-what-to-do

A compromised website needs three things in order: contain it, find out how they got in, then rebuild it clean. Doing those out of order is how sites get reinfected within a day.

Work through this page from the top. It assumes nothing about how the attack happened.

> **Important:** Do not simply delete the suspicious files and carry on. Almost every compromise leaves more than one way back in: a second backdoor, a rogue administrator account, a scheduled task, or a modified core file. Removing the visible symptom and stopping there is the most common reason a site gets hit again the same week.

## Signs You Are Actually Compromised

- Search results show pharmaceutical, gambling, or foreign-language pages you never wrote.
- Visitors are redirected elsewhere, often only on mobile or only from search engines.
- A browser or search engine shows a warning for your domain.
- Files appear with names or modification dates you cannot account for.
- Your site sends spam, or your domain starts being rejected by mail providers.
- An administrator account exists that nobody created.

Not every one of these means a hack. A site that is merely slow or throwing errors is more often a plugin conflict or a resource limit. See [Website Not Loading](https://support.kapsulehost.com/en-nz/website-not-loading) first if that is all you have.

## Step 1: Contain It

Take the site offline before you investigate. Every minute it stays public is more damage to your reputation, your search ranking, and your visitors.

The fastest way to do that without deleting anything is password protection, which puts a login in front of the whole site at the web server level:

1. Go to **Websites** and open the site.
2. Open the **Password protect** tab.
3. Enable it and set a username and password.

The site now returns a prompt to every visitor including the attacker, while you keep full access through the panel, SFTP, and SSH.

![The site Security tab in KPanel showing the malware scan, IP block list and protections](https://support.kapsulehost.com/help/screenshots/site-hacked-what-to-do.27484098.webp)

If you know the attacker's IP address, add it to the **IP block list** on the site's **Security** tab as well.

> **Warning:** Do not delete the site, and do not restore anything yet. The current state is your only evidence of how the attack worked. Take a backup of the compromised site now, label it clearly as infected, and keep it somewhere separate. You may need it.

## Step 2: Work Out How They Got In

There are only a few realistic answers, and each one changes what you do next.

**Check the panel audit log.** Go to **Settings**, then **Account**, then **View log**. Actions attributed to your team from an IP address none of you use mean your KapsuleHost account itself was reached. That is a much bigger incident: see [Account Security](https://support.kapsulehost.com/en-nz/account-security) and treat the account as compromised too. The site's **Activity** tab covers changes made through the panel.

**Check your error and access logs** on the site's **Logs** tab. Repeated requests to a single plugin path, or a burst of POSTs to an upload endpoint, usually names the way in. See [Reading Error Logs](https://support.kapsulehost.com/en-nz/error-logs).

**Run a malware scan** on the site's **Security** tab. See [Scanning For and Removing Malware](https://support.kapsulehost.com/en-nz/malware-cleanup) for how to read the result.

**Check what was out of date.** An outdated plugin, theme, or core version is by far the most common entry point. See [Keeping WordPress Updated](https://support.kapsulehost.com/en-nz/wordpress-updates).

## Step 3: Rebuild Clean

There are two ways to end up with a clean site, and only one of them is reliable.

### The Reliable Way: Restore from a Backup Taken Before the Compromise

Work out roughly when the compromise started from your logs, then restore from a backup taken comfortably before that date.

1. Go to the site's **Backups** page.
2. Pick a backup from before the infection.
3. Restore it **to staging first**. The restore dialog defaults to staging deliberately.
4. Check the staging copy: no unknown files, no unknown admin users, no redirects.
5. When you are satisfied, restore to live. Restoring to live requires you to type the domain name to confirm.

See [Restoring From a Backup](https://support.kapsulehost.com/en-nz/restoring-from-backup) for the detail, including how to restore files and the database separately.

On WordPress and WooCommerce sites with managed databases, point-in-time recovery on the site's **PITR** tab can restore the database to a specific minute rather than to the last nightly backup. That matters when you would otherwise lose a day of orders.

> **Warning:** A restore rolls back everything, including legitimate content and orders created after that backup was taken. Before restoring, export any data you need to keep from the current site, and be aware that exported content from a compromised site can itself carry injected code. Inspect it before importing.

### The Unreliable Way: Cleaning In Place

If you have no clean backup, you have to clean the site by hand. Be honest with yourself about how thorough this needs to be.

- Quarantine every file the malware scan flags. See [Scanning For and Removing Malware](https://support.kapsulehost.com/en-nz/malware-cleanup).
- Replace WordPress core, every plugin, and every theme with fresh copies from source rather than updating in place.
- Delete any plugin or theme you do not actively use. Inactive code still executes when it is reachable.
- Inspect files the scanner does not cover: `.htaccess`, `wp-config.php`, and anything in your uploads folder that is not an image.
- Check scheduled tasks on the site's **Cron jobs** tab for jobs you did not create.
- Check the database for injected content, particularly in options and post content.

## Step 4: Change Every Credential

Assume everything the site could reach has been taken.

- **WordPress administrator passwords.** Reset every one from the site's **WordPress** tab, force every user to sign out so stolen session cookies stop working, and delete any application passwords you did not create. See [Resetting a WordPress Password](https://support.kapsulehost.com/en-nz/wordpress-reset-password).
- **Unknown administrator accounts.** Delete them, and demote any account that does not need administrator rights.
- **Database credentials**, on the site's **Database** tab.
- **SFTP accounts** on the site's **SFTP** tab. Deleting one terminates its open sessions.
- **SSH keys** on the site's **SSH access** tab. Remove any key you do not recognise.
- **Your KapsuleHost password**, and revoke any API keys you did not create. See [API Keys and Developer Access](https://support.kapsulehost.com/en-nz/developer-api-access).

## Step 5: Bring It Back and Harden It

Once you are confident the site is clean, turn off password protection and let the world back in.

Then close the door that was open:

- **Keep everything updated.** See [Keeping WordPress Updated](https://support.kapsulehost.com/en-nz/wordpress-updates) and [Managing Plugins](https://support.kapsulehost.com/en-nz/wordpress-plugins).
- **Turn on the security protections** on the site's **Security** tab: brute-force protection, country filtering, and the IP block list.
- **Enable two-factor authentication** on your KapsuleHost account and on the site's own administrator accounts.
- **Take a fresh backup** of the known-good site. See [Taking a Backup](https://support.kapsulehost.com/en-nz/taking-a-backup).
- **Consider extended backup retention**, so a compromise you do not notice for weeks is still recoverable.

## When to Involve Support

[Open a support ticket](https://support.kapsulehost.com/en-nz/opening-a-support-ticket) if any of these apply:

- The compromise came through your KapsuleHost account rather than the site.
- Your site is sending spam, or your sending reputation has been affected.
- You have no usable backup and cannot get the site clean.
- Your account or site has been suspended. See [Why Your Account Was Suspended](https://support.kapsulehost.com/en-nz/account-suspended).
- You believe another customer's site is attacking yours. See [Reporting Abuse](https://support.kapsulehost.com/en-nz/reporting-abuse).

Include what you found, when you first noticed it, and what you have already changed. The more of your own investigation you can share, the faster the answer.

## Troubleshooting

**Search engines still warn about the site.** Request a review through their own webmaster tools once the site is genuinely clean. That is outside our control.

**It came back after I cleaned it.** You missed a backdoor, or a credential you did not change is still valid. Restore from a clean backup instead, and change every credential in Step 4.

**The scan says clean but the site is clearly compromised.** File scanning catches known malicious code, not injected database records. Compare against a backup and check the database.

**I cannot get in to fix it.** Use SFTP or SSH rather than the application's own login, which the attacker may have changed. See [SFTP Access](https://support.kapsulehost.com/en-nz/sftp-access) and [File Manager](https://support.kapsulehost.com/en-nz/file-manager).