We have come across many clients who came to us because their WordPress Website was hacked. That is one of the most discouraging experiences you can have.
A website when hacked can lose all its credibility and rankings on the web. Yes, you read it right! You can lose all the SEO and website optimisation hard-work that you have put up in bringing your website on top of the search results page. All the trust that you have garnered from your audiences during all these years can get negatively affected and hence you can lose your standing on the web.
But there is good news!
You can find out how the website was hacked and what was the security shortfall by investigating your website logs. Then you can fix the shortfall and avoid such breaches in future. But hey, doing all these things on your own can be a cakewalk for some and difficult for some website owners.
Considering this, we bring you “My Website is Hacked” WordPress Edition. How to fix your hacked WordPress website. Let’s get started!
Step 0 – Hire Professionals to do it for you
If you can pay some amount to get a professional solution for this, you should not hesitate in doing so. You can hire professionals who are specialised in doing these tasks. This will help you with 2 things viz. your website will be in safe hands and there is less risk of things going wrong with your website.
Step 1 – Identify the hack
WordPress always has been an ‘easy to use’ software. People who are not so tech-savvy find it comfortable to use it for their websites and blogs. Similarly, identifying a hack can be an easy task if done correctly. All you have to do is to get the answers to the below questions & keep it documented.
- Are you able to login to your WP Backend?? (your-url.com/wp-admin/)
- Does your website have any illegal popups?
- Does your website redirect you to a different website?
- Does your website have any unknown/illegal links?
- Has google marked your website as insecure?
Step 2 – Contact your Hosting Company support
Once you have all the answers to the questions listed above, its time for you to contact your hosting company support team. These guys are generally good and supportive in such situations. However, it completely depends on how good your hosting company is? Many beginners tend to go for poor options due to lack of knowledge or experience.
Support teams are fully equipped to deal with such kind of situations. You can inform them about your initial investigation (answers to the list of questions above). It is advisable not to do anything by yourself, not before getting in touch with your hosting company. Act on their advice.
Another thing that can be pointed out is, if your website is hosted on a shared server, the hacker could have gained access to your site via another website on that shared server. In such a case, it puts your hosting company in a position to answer how the hack started and how it spread to other websites. They might also identify the entrance from where the hackers gained access to your website.
In this scenario, it is the responsibility of your hosting company to clean the hacked website. If not, you should change your hosting company.
Step 3 – Use a security plugin & Scan your website
If you have the bad habit of not updating your WordPress themes and Plugins regularly then you are inviting hackers to your website. It is more susceptible to get hacked as out-of-date files in your WordPress ecosystem can act as a gateway for hackers and then they can create a backdoor to quickly gain access to your site in the future.
Here a security plugin plays an important role so that you can track the activities happening on your site in real-time. Personally, I would recommend using Wordfence Security. It is a freemium plugin that provides 2FA login security, real-time scans, security update definitions, IP blocking and so on.
You can hire us to maintain & secure your website
Step 4 – Restore Backup of your WordPress Website
As important it is to update your website frequently it is also imperative to back up your website regularly. If your website is hacked or crashed it becomes easy to restore to the previous version directly (note: the version where your website was not hacked). After installing the backup manually, remove the file, plugin or theme that was vulnerable to hackers.
Yes, you will lose all the changes that you had made to the website. However it is better to re-work on a clean website and secure it first and then work on it.
You can check out daily back up plans with us or your hosting company if it provides one.
If you don’t wish to spend on backups and you have extra time you can try All-in-One WP Migration Plugin to take localised backups of your WordPress website.
Step 5 – Check User Rights
It is necessary for you to check the user permission that you have provided to access your website. You have to re-check them again and see if any suspicious activity is traced to a specific user role.
Check if there is any new user role that was not created by you or was not available earlier. If you find any such user role, remove it immediately.
Do not forget to update your password.
Step 6 – Change WordPress Security Keys
In every WordPress installation, there is a set of Security keys which you can find in your wp-config.php file. Now if your website is hacked there is a possibility that hacker is still logged into the website. In such a case, you need to change the WordPress Salt keys. Once these are changed, the logged-in user gets auto-logged out. That is a good time to change your password.
After completing all the mentioned steps, you now know how to fix the hacked WordPress website. However, WordPress is a highly used CMS and is a frequent target of hackers so there are chances that your website can be targeted again. Hence, it is advisable to do continuous work on maintaining your website security and keeping an eye on malicious activities happening on the web.
You can hire an agency like us to meet all your needs to maintain your WordPress Website. We will support you in all aspects like Website Security, Real-time updates, timely backups & Uptime monitoring. If you think your website is hacked and want swift solutions contact us.