How to tell whether your website is infected, and what to do, step by step: passwords, cleaning up, updates and checking with search engines.
Signs of a hack: the site redirects visitors to other people’s pages, it shows adverts or links you didn’t add, your browser or a search engine warns that the site is dangerous, spam is being sent from your domain, or there are unfamiliar files in your folders. Work through the steps in order.
1. Change your passwords
All of them: your cPanel password (in the Password & Security section), FTP accounts, website administrators and mailboxes. If you change the database password, update it in your site’s settings too. Also scan the computer you log in from with antivirus software: passwords are often stolen from there.
2. Remove the infection
The most reliable way is to restore the site from a backup dated before the hack — your own or ours. To find out how to ask for ours, see Website backups.
If you have no backup, you will have to search by hand. In File Manager, sort the files by modification date: recently changed PHP files are suspicious, especially in folders for images and uploads. A common sign of infection is a line like eval(base64_decode( in the code.
3. Close the hole
Sites are usually hacked through an out-of-date CMS, plugin or theme. Update everything to the latest versions, and delete any plugins and themes you don’t need — disabled ones can be dangerous too. Check your file permissions as well: File and folder permissions.
4. Tell the search engines
If Google or Bing has already marked your site as dangerous, ask them to re-check it once it is clean: use Google Search Console and Bing Webmaster Tools.
If you can’t get to the bottom of it, contact our support team and we will point you to where to look.
Didn’t find the answer? Ask our support team — we’ll help.