Millions of websites get hacked every year. Hacking is a very general term that implies that a third party has gained access to a website for a malicious reason. It may manifest itself in different ways on your website. We will assume that you know or think that your website is hacked.
Save yourself time and let us clean up your website for you.
We will do this for a one time-fee - with no ongoing commitment. We'll also put steps in place to protect your website in the future.
The Ultimate Website Cleanup Guide
These are the steps our team members follow when cleaning up a website that has been hacked. It covers preparation, cleaning, and future protection. Note that every infection is different.
1. Take a copy of the site and database
We will be making substantial changes to the website files and databases over the next few hours, including replacing core files and making edits to the database. It is therefore extremely important that we take a copy of the site as it is at the moment so that we can roll back.
Obviously, this copy we are taking is infected, so this backup is a worst case option. If any one of the steps below is complicated or takes a long time, we should take another backup afterward. Backups should be taken of both the files and the database.
2. Check for older backups
Have any other backups of the website been taken before the hack? If so, it may be possible to roll back the site to a previous version. Even if a backup is restored, follow each step of this guide to ensure the site is fully clean.
3. Take the website offline
It is advisable for us to take the website offline. This achieves three things:
1. It stops visitors from being infected by malicious content on the website.
2. It prevents further exploits, especially as we clean the site.
3. It prevents a broken or hacked site from being further indexed by search engines.
The website is taken offline most quickly through a .htaccess file with the following content (replace 1.1.1.1 with your IP address):
- Order deny, allow
- Deny from all
- Allow from 1.1.1.1
This will show all other website visitors a 403 Forbidden message.
4. Clear out Website Caches
CMS websites support various caching applications, which speed up a site by showing a cached version of the website rather than a live version. To ensure that our fixes are taking effect, and also that no infections are present in the cache files themselves, we need to clear these caches.
These caches can be cleared in the CMS Admin Area, but we can comprehensively empty these folders using FTP, SFTP or SSH.
5. Replace the CMS Core Files
The Core Files include all standard CMS files
Often, attackers place malicious files within the CMS core files. These can be disguised in the form of a system file.
1. Download the latest stable version of WordPress or Joomla.
2. Ensuring that a backup has successfully been taken, every other folder and file can be deleted.
3. Upload the latest version of your CMS.
4. Navigate to the website to ensure that it loads.
6. Manually check the configuration file
The configuration file provides the key CMS configuration, such as linking the site to the database. This should be manually checked for any anomalies. It can be compared to the original configuration file in the CMS download.
If in any doubt, replace the configuration file, updating the database credentials as required.
7. Manually check the .htaccess file
Some of the sneakiest hacks are directed at specific visitors only - for example, those coming from Google. These often edit the .htaccess file.
The .htaccess can be cut down to include only the following code:
# BEGIN
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END
The RewriteBase and RewriteRule sections may need updating based on the website structure.
8. Clean Plugins and Themes
There are a few ways we can clean themes and plugins.
The simplest is to remove and reinstall them.
Quick Fix
1. Log in to the web server using FTP or SSH
2. Delete all of the themes and plugins, taking note of their name. It is important to do this from the file system and not the CMS admin area; removing them from the latter will clear any configuration from the database.
3. Log in to the CMS Admin area.
4. Re-install the themes and plugins from scratch. Of course, there's no need to reinstall plugins and themes that aren't activated or being used.
This will reset your themes and plugins.
Detailed Scan
If these themes and plugins are custom, or not available in the CMS repository, then the files need to be searched for any exploits.
Maldet should be run against the whole CMS files.
Files can be searched for base64, exec, eval, preg_replace. False positives may be found, but any instances can be investigated.
Sort files by last modified date, and see the latest file uploads.
9. Clean the Uploads Folder
The Uploads file is where CMS places uploaded media. There should be no .php or executable files here. An uploaded .php file here could be run to give a third party access to your files and make changes to the website.
Connect over ssh, navigate to /uploads/, and run the following command:
- find . -type f -name "*.php"
Alternatively, use an FTP client to search for .php files. They can be removed.
As a further preventative step, a .htaccess can be added to the /uploads folder with the following content:
- <Files *.php>
- deny from all
- </Files>
10. Clean up users and permissions
Some hacks can add additional users and permissions to the CMS database. Sanity check the wp-users table in the database and review the admin users in the CMS Admin dashboard.
All user passwords should be changed.
11. Ensure Themes and Plugins are still supported
Third party themes are built by developers. If they go out of business or disappear, then those themes will not be updated and vulnerabilities no longer fixed. Check that the plugins the site is using are still maintained. If not, replace them with alternatives.
12. Check and Clean the Database
Sometimes code can be placed in the database which, when loaded, runs an exploit. A similar php execution language is used to script exploits. Databases can be searched for the following terms:
base64_encode, exec, base64_decode, preg_replace, eval These references should be investigated and removed if required.
Extreme Database Fix
Similar to files, any CMS has core tables and additional features. For most websites, the database stores Pages and Posts.
An extreme fix is therefore for us to install a brand new database, and retrofit the content into the database.
Note that this will require creating new users, reconfiguring themes, re-adding pages, and more. However, it essentially creates a new version of the CMS website with a clean database.
13. Update Everything
Now that the infection has been removed, we need to close the hole. We should do the following:
- Update CMS (this should be up to date as we have replaced the core, but we can ensure this in the CMS Admin Area).
- Update all themes and plugins
- Remove any unused themes and plugins
14. Run a security scan
Run a scan against the website to find any known vulnerabilities. Aussie Wide Websites has an internal vulnerability scanner available for all website clients.
15. Change all passwords
This includes :
- hosting passwords
- ftp passwords
- database passwords
- admin passwords
16. Bring the site back online
If your site is offline, you can now ask support to unblock it.
You should also remove the lines you added to your .htaccess file.
17. Remove Site Blacklistings
If third party scanning sites have marked a site as containing malware, they will still be blocking access as this is not real time.
Site re-scans can now be requested in some cases; in some others, the scan may take a few days.
18. Take a Back Up
Take a backup now and set up regular backups. This can be done with Aussie Wide Websites.