Your website is more than a few pages that tell people about your work; it’s the heart and soul of your business. It reflects everything you do. It’s your prime real estate online, your corner of the Internet and you want to keep it safe. But, sadly, cyber-attacks and hacking are becoming increasingly common, with over half of all businesses in the UK suffering from some form of cyber security breach or attack in the last 12 months.
Having your website hacked is a very stressful experience, so it’s very important to be empowered and to know what to do if you ever find yourself in this situation. Without wanting to worry you, today I’ll explain the practical steps you’ll need to take if your website is hacked and what you’ll need to do to get back on track. I’ll also share some tips for making sure it never happens again.
What is hacking?
First, let’s understand what hacking means. Hacking happens when someone (the hacker) gains unauthorised access to your computer system or website to steal data, disrupt the services you offer, or gain control over your systems.
For small businesses, the most common hacking events are phishing attacks, where fraudulent emails trick you into revealing sensitive information; malware infections, where malicious software corrupts or steals your data; and “brute force” attacks, where hackers use automated tools to guess your passwords and gain unauthorised access to your system.
1. How to tell if your website has been hacked
Here are some signs that your WordPress website might be under attack.
Unusual behaviour
- If you or other admins can’t log in to your account or changing your password doesn’t help, it could be a sign that hackers have taken over.
- If your visitors are being redirected to unfamiliar sites or spammy URLs, this could be a sign that your site is being hacked.
- A sudden and unexplained slowdown in your website’s speed can also mean that malicious code is running in the background.
- Unexpected changes to your site’s content or appearance might mean someone is accessing your website without your authorisation.
Suspicious activity
- If you spot new user accounts you didn’t create, it’s a red flag that you might be hacked.
- If search results are returning spammy keywords you should check your site.
- Also, look out for unfamiliar files or code. These could be embedded malware or “backdoors” used by hackers.
Security alerts
- Watch out for any unusual browser warnings when visiting your site. If malware is detected, browsers will return a warning notification to prevent users from accessing it.
- If your security plugins like Wordfence or Sucuri start sending you notifications, make sure you check them out.
- Your hosting provider will usually monitor for malicious activity and alert you if something seems wrong. Make sure you pay attention to any alerts they send you.
2. What to do straight after a hack
If you know your site has been hacked, it’s essential to take action straight away. Here’s what you should do first.
Change passwords
Change all the passwords associated with your site, including admin, FTP, hosting, and email passwords. Use a password generator to create strong, unique passwords and consider using a manager like 1Password or LastPass.
Backup your site
Even if your site is compromised, creating a backup is a very important step. It gives you evidence of the hack and could also restore your site to a previous version. You can use backup plugins like UpdraftPlus or BackupBuddy or find your backups through your hosting provider’s control panel.
Maintenance mode
Put your site in maintenance mode to stop legitimate visitors from seeing the compromised content. Plugins like WP Maintenance Mode can display a friendly notice telling people what’s happened.
Temporary shutdown
If the hack is severe, you might want to consider temporarily disabling your site. You can do this via your hosting control panel.
Contact your hosting provider
Let your hosting provider know that you think your site has been hacked. They can investigate and advise you on any additional actions you need to take.
3. Assess the extent of the damage
Once you’ve secured your site, you’ll need to assess the damage.
Check for malware
Security Plugins like Sucuri SiteCheck or Wordfence can scan your site for malware. They’ll help identify any malicious code or files that may have been added.
Review user accounts and permissions
The next step is to log in to your WordPress dashboard and check the Users section. You’ll need to remove any accounts that you didn’t create or that seem suspicious. Ensure existing users have the correct permissions and remove any inactive users.
Inspect files and database
This is a slightly more involved step, but if you feel confident, look at your site’s files for any unusual modifications. Check your `wp-content` directory and core files for any unfamiliar entries or modifications. Be careful, as changing your website’s direct database can cause more problems if not handled correctly.
4. Cleaning up your hacked WordPress website
Now that you’ve assessed the damage, it’s time to clean up.
Remove malicious code
If you’re comfortable coding, you can manually inspect and remove malicious code from your files, but be careful not to delete legitimate files accidentally. If you prefer, you can use plugins like Wordfence or Sucuri, which are tools that can scan for and remove any malicious code.
Add Two-Factor Authentication
You can also add an extra layer of security to your site by implementing Two-Factor Authentication (2FA), which can protect your login credentials from being compromised again.
Restore your site from backup
If you have a clean backup from before the hack, restore your site to that version. Follow the instructions for restoring files and databases provided by your backup plugin or hosting provider.
5. Reinstall WordPress core and plugins
After cleaning up, reinstalling WordPress and core plugins can help ensure that all the files that have been compromised files are replaced:
Reinstall core files
Obtain a fresh copy of WordPress from the official site and replace the core files via FTP to make sure no malicious code remains.
Update and reinstall plugins and themes
Make sure all your plugins and themes are updated to their latest versions. Remove any that are not essential or come from untrusted sources. If you suspect that a plugin or theme was compromised, then make sure you reinstall it from a reputable source.
6. Securing your site to prevent future hacks
You’ll want to do everything you can to avoid future hacks, so take some time now to strengthen your site’s security. With a few preventative and ongoing measures, you can keep your site safe and secure.
- Create secure passwords.
- Use a password manager.
- Regularly change passwords and login details.
- Set up two-factor authentication – 2FA.
- Schedule regular updates on WordPress, themes and plugins.
- Install security plugins – Wordfence or Securi.
- Run regular security scans to monitor your site’s health.
- Create a regular backup of your site.
- Monitor access, permissions, and user roles.
- Remove any redundant or unauthorised users.
- Use current PHP versions.
- Use a reputable hosting provider.
- Make sure SSL is up to date.
If you don’t want to do all this yourself, that’s ok. That’s why I created the Worry-Free Maintenance Plan – to keep your website safe and secure, offer you priority support and give you the peace of mind you need. Come and ask if you have any questions about how the plan works.
Conclusion
When your WordPress website is hacked, it’s a stressful experience, but it’s good to know there are practical steps you can take to fix it all up and prevent it from happening again. By following the steps I’ve set out for you in this blog and installing the plugins I’ve suggested to help you clear up the mess, you can bring your site back to life.
And maybe, once the dust has settled and you’re back online, you can use the experience to learn from and ensure your site is protected from future hacks by implementing more robust security measures and regular backup procedures or purchasing a monthly maintenance plan.
While the steps I’ve set out for you will help you get your website back up and running, it can be an overwhelming process. If you need any help getting your website fixed up after a hack, or you’re looking for a regular maintenance package, please get in touch to see if I can help. I can also help you protect your WordPress website from getting hacked in the first place, so drop me a line, and we can chat.
