What to Do if Your Website Is Hacked

Overview

Discovering that your website may have been hacked can be alarming, but acting quickly and carefully can help limit the damage.

A compromised website may show obvious signs, such as:

• Unexpected pages or content

• Strange redirects

• Unfamiliar users or administrators

• Spam being sent from the website

• Security warnings from browsers or search engines

• Unexpected files

• Changed website settings

• Unknown plugins or applications

• Pages that have been replaced or defaced

• Unusual server or account activity

Not every unusual website problem means the site has been hacked. However, if you suspect a compromise, treat it seriously until you can determine what happened.

First: Don't Panic

The most important thing is to avoid making the situation worse.

Do not immediately:

• Delete large numbers of files.

• Reinstall WordPress.

• Restore an old backup without investigating.

• Change random hosting settings.

• Delete suspicious files without preserving a copy.

• Give your hosting credentials to someone you do not trust.

A rushed cleanup can destroy useful evidence or remove files that are actually part of your website.

1. Determine What You Are Seeing

Start by documenting the problem.

Record:

• Your domain.

• The affected URLs.

• What visitors are seeing.

• When you first noticed the problem.

• When the website last worked normally.

• Any suspicious messages or redirects.

• Any unexpected users or files.

• Recent changes you made to the website.

Take screenshots when appropriate.

This information can be extremely useful when determining how the compromise occurred.

2. Secure Your Accounts

If you believe someone gained access to your website, change the passwords associated with the affected systems.

This may include:

• Your Have Freedom Hosting account.

• Your cPanel account.

• Your WordPress administrator account.

• FTP accounts.

• Email accounts associated with the website.

• Your domain registrar account.

• Third-party services connected to the website.

Use a unique, strong password for each important account.

If two-factor authentication is available, enable it.

Do not reuse the same password across your hosting, email, WordPress, and domain accounts.

3. Check WordPress Users

If you use WordPress, review your users.

Go to:

WordPress Dashboard → Users

Look for:

• Unknown administrators.

• Users you did not create.

• Unexpected email addresses.

• Accounts with unusually high privileges.

If you find an account you do not recognize, do not assume it is harmless.

Document the account before deleting it.

If you are unsure whether an account is legitimate, contact Have Freedom Hosting Support or the person who manages your website.

4. Check Plugins and Themes

Review your installed WordPress plugins and themes.

Look for:

• Plugins you did not install.

• Themes you do not recognize.

• Recently modified plugins.

• Disabled plugins that were previously active.

• Unofficial or pirated software.

• Plugins or themes that have been abandoned or are no longer maintained.

Do not automatically delete suspicious files before documenting them.

If a compromise occurred through a plugin or theme, simply deleting one file may not remove the rest of the compromise.

5. Check Your Website Files

You can inspect your website through:

cPanel → Files → File Manager

Review the website's document root and look for unexpected files or directories.

Common areas worth reviewing include:

public_html/

and, for WordPress:

wp-content/

Be careful when reviewing files.

Many legitimate WordPress files can look unfamiliar if you aren't used to working with the software.

Do not delete files simply because you don't recognize them.

6. Look for Recently Modified Files

Unexpected changes to website files can provide useful clues.

Depending on your cPanel configuration, File Manager can help you review files and their timestamps.

Look for files that were modified around the time the compromise began.

Pay particular attention to unexpected changes involving:

• PHP files.

• .htaccess.

• WordPress configuration.

• Plugin files.

• Theme files.

• Upload directories.

A modified timestamp alone does not prove that a file is malicious, but it can help establish a timeline.

7. Check Your FTP Accounts

Review your FTP accounts through:

cPanel → Files → FTP Accounts

Look for accounts you do not recognize.

If an FTP account is no longer needed, remove it.

If you suspect an existing FTP account was compromised, change its password.

Remember that FTP access is only one possible way a website can be compromised.

8. Check Your WordPress Configuration

Review important WordPress configuration files, particularly:

wp-config.php

Look for unexpected changes.

Do not modify configuration values unless you understand what they do.

If you suspect that database credentials or other sensitive values have been exposed, change the affected credentials and update the website configuration accordingly.

9. Check for Unexpected Redirects

A hacked website may redirect visitors to another website.

Redirects can be caused by:

• Modified .htaccess.

• Compromised WordPress plugins.

• Modified theme files.

• Injected JavaScript.

• Malicious PHP code.

• DNS changes.

Check:

cPanel → Domains → Redirects

Also review .htaccess and your WordPress configuration.

Remember that not every redirect is malicious. Many websites legitimately use redirects.

The important question is whether the redirect was intentionally configured.

10. Check DNS and Domain Settings

A website can be compromised without the website files themselves being modified.

If your domain's DNS was changed, visitors could potentially be sent somewhere completely different.

If DNS is managed through cPanel, review:

cPanel → Domains → Zone Editor

Look for unexpected changes to:

• A records.

• AAAA records.

• CNAME records.

• MX records.

• TXT records.

• Other DNS records.

If your DNS is managed by another provider, check the records there instead.

Also review your domain registrar account if you suspect someone gained access to it.

11. Check Email Accounts and Forwarders

If your website and email accounts are hosted together, a compromise may affect email as well.

Review:

cPanel → Email → Email Accounts

and check for unfamiliar mailboxes.

Also review:

• Email forwarders.

• Autoresponders.

• Email filters.

• Mailbox settings.

An attacker may create forwarding rules to secretly receive copies of messages.

If you discover an unexpected forwarding address or mailbox, document it before removing it.

12. Check Your Website's Email Authentication

If you believe your account was compromised and email was involved, review your email authentication settings.

In cPanel, check:

cPanel → Email → Email Deliverability

Look for issues involving:

• SPF.

• DKIM.

• Domain configuration.

Unexpected DNS changes can affect email delivery and authentication.

13. Consider Whether the Problem Is Actually a Compromise

Not every website problem is a hack.

For example:

• A broken plugin can cause a 500 error.

• A DNS change can make a website appear unavailable.

• A failed WordPress update can break the website.

• An expired SSL certificate can trigger browser warnings.

• A changed .htaccess file can create redirects.

• A deleted file can cause 404 errors.

Before declaring the website compromised, determine what evidence you have.

When in doubt, treat suspicious activity seriously and investigate it.

14. Preserve the Current State

Before performing a major cleanup, preserve what you can.

Depending on the situation, this may include:

• Website files.

• Database.

• Error logs.

• Access logs.

• Screenshots.

• Suspicious filenames.

• Timestamps.

• DNS records.

• Relevant account information.

This can help establish what happened.

It can also make it easier to recover information that was accidentally removed during cleanup.

15. Consider Restoring From a Backup

If you have a known-good backup from before the compromise, restoring it may be part of the recovery process.

However, restoring a backup does not automatically fix the underlying security problem.

If the attacker still has access to:

• Your hosting account.

• WordPress.

• FTP.

• Your domain registrar.

• An administrator account.

• A vulnerable plugin.

the website may simply become compromised again.

Secure the affected accounts and determine the likely entry point before relying on a backup as the complete solution.

16. Keep in Mind That Backups Can Also Be Compromised

If you maintain multiple backups, do not assume every backup is clean.

A compromise may have existed for days or weeks before it was discovered.

If you restore a backup made after the compromise occurred, malicious files or configuration changes may still be present.

When possible, choose a backup from a point in time when you have reason to believe the website was clean.

17. Update Everything

Once access has been secured and the website has been investigated, bring supported software up to date.

This may include:

• WordPress.

• Plugins.

• Themes.

• PHP.

• Other website applications.

Remove software that is no longer needed.

Old or abandoned software can create security risks even if the original compromise has been removed.

18. Remove Unused Access

Review who and what has access to your website.

Remove accounts and access that are no longer needed.

Check:

• WordPress users.

• FTP accounts.

• Hosting users.

• Domain users.

• Third-party integrations.

• API credentials.

• Application access.

The fewer unnecessary access points your website has, the easier it is to protect.

19. Consider Adding Website Security Protection

If your website is important to your business, consider adding additional protection after resolving a compromise.

Have Freedom Hosting offers website firewall and malware scanning services that can provide an additional layer of protection for supported websites.

These services can help with:

• Monitoring for suspicious activity.

• Detecting potentially malicious files.

• Identifying known malware.

• Blocking certain malicious web traffic.

• Providing an additional layer of protection between visitors and your website.

A website firewall and malware scanner should be considered additional security, not a replacement for keeping WordPress, plugins, themes, and other software updated.

If your website has already been compromised, clean and secure the website first rather than assuming a security service will automatically repair an existing infection.

If you're interested in adding website firewall or malware scanning protection to your hosting service, contact Have Freedom Hosting Support or review the available security services through your customer account.

20. Review Your Website After Cleanup

After cleaning or restoring the website, test it thoroughly.

Check:

• Homepage.

• Important pages.

• WordPress Dashboard.

• Contact forms.

• Login functionality.

• Email.

• Downloads.

• Images.

• HTTPS.

• Redirects.

• DNS.

• Mobile pages.

Also check whether the suspicious behavior has returned.

21. Check Search Engine and Browser Warnings

A compromised website may be flagged by search engines or browsers.

Visitors may see warnings indicating that the website contains:

• Malware.

• Deceptive content.

• Phishing content.

• Suspicious downloads.

If your website has been cleaned but a warning remains, you may need to follow the appropriate review or security-removal process with the affected service.

Do not simply ignore the warning.

When to Contact Have Freedom Hosting

Contact Have Freedom Hosting Support as soon as possible if you believe your hosting account or website has been compromised.

Especially contact support if:

• You find unexpected files.

• You discover an unfamiliar administrator.

• You suspect someone accessed your hosting account.

• Your website has been defaced.

• Your website is redirecting visitors unexpectedly.

• Your DNS appears to have been changed.

• Your account is sending suspicious email.

• You cannot determine how the compromise occurred.

• You need help identifying hosting-level activity.

• You need assistance determining what information should be preserved before cleanup.

• You are interested in adding website firewall or malware scanning protection.

When opening a support ticket, provide as much useful information as possible:

• Domain name.

• Affected URLs.

• When you noticed the problem.

• What you are seeing.

• Recent changes.

• Suspicious files or accounts you discovered.

• Relevant screenshots.

• Relevant error messages.

• Any actions you have already taken.

Never include passwords, private keys, authentication codes, or other sensitive credentials in a support ticket.

Important: Contact Your Other Providers Too

Your hosting account may not be the only account involved.

If you suspect broader account compromise, review and secure:

• Your domain registrar.

• Your email provider.

• Third-party services.

• Payment accounts.

• Website management services.

• CDN or DNS providers.

• Any account that shares credentials with the affected website.

If the same password was used elsewhere, change it there as well.

Quick Website Compromise Checklist

• Document what happened.

• Take screenshots.

• Secure your hosting account.

• Change affected passwords.

• Enable two-factor authentication where available.

• Review WordPress administrators.

• Review plugins and themes.

• Review website files.

• Check recently modified files.

• Review FTP accounts.

• Review wp-config.php.

• Check redirects.

• Check DNS and Zone Editor.

• Review email accounts and forwarding.

• Review email authentication.

• Preserve evidence before major cleanup.

• Identify a known-good backup if restoration is necessary.

• Update WordPress, plugins, themes, and other software.

• Remove unnecessary access.

• Consider website firewall and malware scanning protection.

• Test the website after cleanup.

• Check for browser or search-engine warnings.

• Contact Have Freedom Hosting Support if you need assistance.

Need Help?

If you believe your website has been hacked, do not wait for the problem to get worse.

Secure your accounts, document what you are seeing, and avoid making destructive changes until you understand what happened.

Have Freedom Hosting Support can help you determine whether the problem appears to be related to your hosting environment and can assist with hosting-side troubleshooting.

For additional protection, Have Freedom Hosting also offers website firewall and malware scanning services for customers who want an additional layer of website security.

For complete website malware removal or application-level security work, you may also need assistance from a qualified website developer or security professional.