Website Hack Protection and Recovery
Website hacking has two phases: resolving consequences (active hack) and strengthening protection (prevention of recurrence). Work in this order, not the other way around.
Signs of Hacking
- Google/Yandex shows malware warning
- Site redirects to third-party resources
- New unknown files or pages appear
- Unexplained new admin users
- Server sends spam (blacklisted IP)
Phase 1: Containment
# Put site into maintenance mode
php artisan down # Laravel
# Snapshot for forensics
tar -czf /tmp/hacked-site-$(date +%Y%m%d).tar.gz /var/www/mysite/
# Block suspicious IPs
ufw deny from 1.2.3.4
Phase 2: Diagnosis
# Find modified files from last 7 days
find /var/www/mysite -type f -newer /var/www/mysite/composer.json -name "*.php" 2>/dev/null
# Search for backdoors
grep -r "eval(base64_decode" /var/www/mysite/ --include="*.php"
grep -rn "system\|exec\|passthru\|shell_exec" /var/www/mysite/uploads/ --include="*.php"
# PHP in uploads — sign of webshell
find /var/www/mysite/uploads -name "*.php" -type f
# WordPress: verify checksums
wp core verify-checksums
wp plugin verify-checksums --all
Phase 3: Cleanup
# Deploy clean copy from Git
git clone [email protected]:myorg/mysite.git /var/www/mysite-clean
# Transfer only media files (no PHP)
rsync -av --include="*.jpg" --include="*.png" --include="*.pdf" \
--exclude="*.php" /var/www/mysite/uploads/ /var/www/mysite-clean/uploads/
# Verify with ClamAV
clamscan -r /var/www/mysite-clean/uploads/
# WordPress: reinstall core
wp core download --force
Phase 4: Hardening
# Block PHP execution in uploads
location ~* /uploads/.*\.php$ { deny all; }
# Hide server version
server_tokens off;
# Protect configuration files
location ~* \.(env|htaccess|git)$ { deny all; return 404; }
# Correct file permissions
find /var/www/mysite -type f -exec chmod 644 {} \;
find /var/www/mysite -type d -exec chmod 755 {} \;
chmod 600 /var/www/mysite/.env
# Fail2ban for brute force
# /etc/fail2ban/filter.d/wordpress.conf
# failregex = ^<HOST>.*"POST /wp-login.php
Preventive Measures
- 2FA for all admin accounts
- WAF (Cloudflare, ModSecurity)
- Auto-update critical components
- Login attempt limiting (Fail2ban)
- Regular audit of files and users
Notifying Search Engines of Recovery
- Google Search Console → Security Issues → Mark as fixed → Request review
- Yandex Webmaster → Security → Request check
Warning removal: Google — 1–3 days, Yandex — 1–5 days.
Hack recovery — 1–3 days. Security hardening — 1–2 days additional.