When you’re a website owner that relies on online traffic for enquiries and sales, finding out that you’ve become a WordPress website hack victim can be a stressful experience.
Since so many sites have been built on the WordPress platform, it makes sense that this is one of the most hacked content management systems on the web.
Keeping your site secure is of the utmost importance, no matter how small your business is. However, people who have the right knowledge and skills can find their way into some of the most secure websites. In fact, small business websites are hacked more than large enterprise sites.
Cybercriminals steal 75 records every second. Data such as a customer’s personal information and banking details can be very valuable.
If your website seems to be acting up but you’re not sure whether it’s been hacked, here are a few signs to look out for:
- You can’t access the back end of the site. Not being able to log in could be a sign that you’ve forgotten your password but it can also indicate that your website’s been hacked. Hackers will often remove users and change passwords once they’ve infiltrated a website.
- Your site looks different. Many hackers will replace the homepage of a site with a static page that looks completely different to what the site once did. On the other hand, some hackers start making subtle changes such as introducing malicious links.
- Browsers warnings keep popping up. If your browser is telling you that your website isn’t secure, it could be a sign that it’s been hacked. However, it can also be due to a coding or plugin issue so this should also be explored. You may even find that search engines also state that your site is unsafe – this could be another sign that your site has been hacked.
- Your site keeps redirecting. In some instances, hackers will add code to a website that will cause it to redirect to another site.
What to Do After a Website Hack
The first thing that you want to do when you discover your WordPress website has been hacked is to stay calm. It is not the end of the world and it can be fixed, here’s how:
- Identify the Hack
Before you can do anything else, you need to be able to explain how the hack is affecting your WordPress site. Are you finding malicious links across all pages? Can you not log in? Has your website’s appearance been altered? Basically, it’s whatever you noticed when you started looking into whether your website has been hacked.
- Contact Your Hosting Provider or Support Consultant
If you have a support consultant or developer that you generally work with, you need to get in touch with them as soon as you can. If you don’t, contact your hosting provider about the hack. Whoever you contact, they will need the details you’ve collected so far. If you’re unsure about how your website has been hacked, a support consultant will be able to assist you. You may even find that your website was hacked because you’re on a shared server – something your hosting provider will be able to tell you.
If you don’t have a provider, you can contact us with your Malware removal request here.
- Clean Your Website
If you’re tech-savvy, you may be able to clear up the hack yourself but it’s always faster and easier to hire a professional to assist you. If you would prefer to do everything yourself, you can move onto the next recommended step.
- Restore Your Backup
If you’ve been backing up your WordPress site on a regular basis, you may be able to restore an earlier version of your website. Unfortunately, this means that any changes you made or content/images you uploaded will be lost. However, this will be worth getting your website back to a clean state. You can restore a backup via the cPanel of your website. If you don’t feel that you can lose any changes you’ve recently made, you will need a professional to fix your site by accessing the code.
- Remove Any Malware
Now that you’ve cleaned and restored your website, keep in mind that it’s still vulnerable to attacks. If you haven’t updated your website or plugins in a while, this is the first thing you should do. Hackers can easily find ways to get into your site via outdated files. Before you do this, however, install a security plugin that will scan your site for any malware. This plugin can also be used to keep your website secure going forward.
- Go Through Your User Permissions
Next, make sure that you still recognise all the users on your site and that the permissions haven’t changed. Basically, you want to make sure that an unknown user doesn’t have admin rights. Immediately remove any users you don’t recognise.
- Change All Passwords
Any passwords related to your WordPress site need to be changed, this includes your cPanel and database passwords, not just your website logins. The WordPress password generator can help you with a strong password.
You should also change your FTP and any other passwords that may be relevant. Better to be overzealous here.
By taking these steps, you should be able to get your website back to normal again.
Cyber-attacks occur on a daily basis and hackers are always finding new ways to access WordPress, which is why security needs to be an ongoing effort. Just because you managed to clean out your website once doesn’t mean hackers won’t try it again.
If you’re looking for a team to have on call, contact WP Support Specialists to find out how we can assist.
