Help! My site has been hacked. How do I fix it and how do I prevent it?

It's frustrating when your website has been hacked. We do everything we can to make life hard for hackers, but it can still happen. It's important that you not only repair the damage, but also find out how the hacker got in. Simply restoring a backup isn't enough: it could happen again just as easily.

Do this right away

1. Take the website offline temporarily so it can't harm visitors. You can do this in DirectAdmin under Account Manager, Domain Setup, with Suspend / Unsuspend. Read Suspending a domain or temporarily taking only your website offline.
2. Change all passwords: your My WebOké password, your DA password, FTP accounts, database users, the WordPress or Joomla administrators and your mailboxes. Remove any administrators and FTP accounts you don't recognise. After changing a database password, also update your website's configuration file, such as wp-config.php.
3. Check your own computer for viruses. An infected computer can pass on passwords.

Cleaning up

• Restore a clean version from before the hack with WebOké Backups. You choose a moment from the past 30 days yourself. Choose Full restore, so that files the hacker added are removed as well. Not sure which moment is clean? Then first restore a backup with As a copy alongside the current one and compare at your leisure.
• In DirectAdmin, go to Extra Features and open Imunify360 Plugin to see which files were found to be malicious. Read Imunify360: scanning your website for malware.
• Then immediately update WordPress or Joomla, all plugins and themes. You can do this with Installatron or the Website Manager. After all, the vulnerability is also in the backup.

Would you like our experts to fix the hack for you? That's possible, but it takes time and is therefore not free. Read Hack resolution service.

How did the hacker get in?

• An outdated program, plugin or theme with a known vulnerability. This is the most common cause.
• An easy to guess or leaked password. You can check whether your password has appeared in a leak at haveibeenpwned.com.
• An infected computer with a keylogger.
• A form without validation, which can be used to submit code or spam.

You can find traces in the logs: System Info & Files, Site Summary / Statistics / Logs. Pay particular attention to POST requests from unfamiliar IP addresses. Under Login History in DirectAdmin you can see who logged in and when.

Prevention

• Always keep WordPress, Joomla, plugins and themes up to date. Turn on automatic updates in Installatron or the Website Manager.
• Use FTPS or SFTP instead of plain FTP.
• Use a separate database user for each program, not your DA user.
• Only use well-known plugins and remove anything you don't use.
• Add extra protection to admin folders, for example with a password on a folder.

Google flags your site as dangerous

Is your site marked as unsafe in Google? Clean it up completely first. Then request a review in Google Search Console under Security issues.

See also in the DirectAdmin manual: Imunify360: scanning your website for malware and Can this also be done in My WebOké? WebOké Backups.

Detailed explanation with screenshots: My website has been hacked: step-by-step plan in the DirectAdmin manual.

Want to learn more? Take the free WordPress course, lesson 7.1 How websites get hacked or lesson 7.5 Hacked: recognise, recover and prevent.