Strange redirects, spam pages in Google, warnings in your browser, or emails you didn’t send? Your website may have been compromised. It’s stressful, but it’s fixable, and you don’t have to deal with it on your own.
Calm, methodical help
Most compromises stay hidden for weeks, so the visible symptoms are often only part of the story. I work through a site systematically to find everything that’s been changed, clean it up properly and close the door the attacker came in through, rather than just patching over the obvious bits.
What a recovery involves
- Contain. Stop the damage spreading: lock down access, reset credentials and take a snapshot for investigation.
- Investigate. Check core files against clean copies, hunt for backdoors and injected code, and review logs, users and scheduled tasks.
- Clean. Remove malware, spam pages and rogue accounts, restore clean files and update everything.
- Harden. Fix the vulnerability that let them in, tighten permissions and add protections such as a Content Security Policy.
- Recover. Request blacklist and search engine reviews, clear out spam results and keep a close eye on things afterwards.
Spot the signs early
I’ve written practical guides on how to spot a compromised WordPress site and how I track down and fix a hacked site from the command line. Once you’re back up and running, ongoing maintenance and security help keep it that way.
