Isolate a compromised site before cleanup

Before you begin cleaning up a hacked site, you need two things: the ability to stop your web server from serving pages (or a hosting provider who can do it for you), and account management permissions to view all users, delete users, and reset passwords.

Be aware that you will need to bring the site back online briefly during the recovery process, so your server control should allow for toggling between online and offline states.

Recovery steps

Take the site offline completely

Stop serving content to visitors as your first action. You can halt your web server or point your site's DNS entries to a static page on a separate server that responds with a 503 HTTP status code.

Taking the compromised site fully offline lets you handle administrative tasks with less interference from the attacker. It also prevents malicious code or spam files from being served to visitors. A temporary or intermittent offline period during recovery is unlikely to hurt your site's future ranking in search results.

Your hosting provider can help if you are unsure how to take the site offline. They might, for example, configure a 503 response from outside the infected directories, which is a valid approach. Let them know you will need to switch the site online and offline repeatedly for testing—this helps them set you up with the most self-service method possible.

Simply returning a 4xx or 5xx HTTP status code is not sufficient protection. Harmful content can still reach users alongside these error codes. The 503 status is useful because it signals a temporary outage, but the response must originate from outside the compromised server or site.

A robots.txt disallow directive is also inadequate: it only blocks search engine crawlers, while regular users can still access the harmful content.

Notify your hoster

If you have not already informed your hosting provider, contact them now. If their infrastructure was also compromised, your report may help them understand the full scope of the incident.

Audit and reset all user accounts

  • Review the list of all user accounts on the site and look for new accounts the attacker may have created. If you find illicit accounts, note their names for later investigation, then delete them to block the attacker's future access.
  • Change passwords for every site user and account, including FTP logins, database credentials, system administrator accounts, and all content management system (CMS) accounts.