If your website has been hacked, act quickly but calmly. Most hacked websites can be cleaned and secured again.

Signs of a hacked website

• pages have been changed or show content you didn't add
• visitors are redirected to spam or scam websites, sometimes only on mobile or when arriving from Google
• Google or your browser shows a warning that the site may be hacked or harmful
• search results show pages you didn't create, often in another language
• there are WordPress admin users you don't recognise
• your email account sends spam or you receive bounces for emails you didn't send
• Imunify360 reports malware on your account

What to do

1. Tell us. Open a Technical Support ticket. We may already have spotted the problem. We can scan your account, show you the affected files and restore a clean backup for you. The first restore we carry out for each service in a calendar month is free. Each further one that month costs RM30, invoiced before the restore. Cleaning or rebuilding the website itself is for you or your web developer.
2. Check your own computer. Run a full virus scan before you change any passwords, as passwords are often stolen from infected devices.
3. Change all your passwords from a clean device: DirectAdmin, FTP accounts, email accounts, the Client Area, your database user (then update wp-config.php to match) and every WordPress admin user.
4. Remove unknown users. In WordPress, go to Users and delete any administrators you don't recognise.
5. Scan and clean your files. See Scanning for and cleaning malware with Imunify360.
6. Update everything. Update WordPress, plugins and themes. Delete any you don't use and replace any pirated ("nulled") ones with genuine copies.
7. Check for leftovers. Look for unfamiliar PHP files in public_html, unexpected redirects in .htaccess, cron jobs you didn't create and email forwarders you didn't set up.

Restoring a backup

If you have a clean backup from before the hack, restoring it can be the quickest fix. See Restoring from a backup. Change your passwords and update everything straight after restoring, otherwise the attacker can get back in the same way.

If Google has flagged your website

After cleaning your website, request a review in Google Search Console. The warning is removed once Google confirms the site is clean, which usually takes a few days.

Preventing it happening again

See How PaduHost protects your website for the steps that make the biggest difference.

We'll do our best to help troubleshoot WordPress, plugins, themes and other third-party software, but for in-depth help, please contact the software's developer or its official support forum.