Security Checklist: What to Do If Your Website Has Been Hacked or Defaced Print

Introduction

When your website has been hacked or defaced, quick action is critical to minimize damage, recover your site, and maintain your reputation. This comprehensive security checklist will guide you through the steps to respond to a compromise effectively and prevent future attacks.

1. Assess the Damage

• Identify the extent of the hack or defacement:
  • Look for modified files or unauthorized changes in your website's directories.
  • Check your database for suspicious entries.
  • Review user accounts for unauthorized access or new, unknown accounts.
• Use tools like Google Search Console or hosting security alerts for insights.

2. Take Your Website Offline

• Temporarily disable your website to prevent further damage and protect visitors:
  • Enable maintenance mode using a plugin like "WP Maintenance Mode" (for WordPress).
  • Disable public access via your hosting control panel or web server settings.

3. Change All Passwords Immediately

• Change passwords for:
  • Hosting control panel (e.g., cPanel, DirectAdmin).
  • FTP/SFTP accounts.
  • Website admin accounts (e.g., WordPress admin).
  • Database users (update configuration files with the new database credentials).
• Use strong, unique passwords for all accounts.

4. Update All Software

• Update the following to their latest versions:
  • WordPress core, themes, and plugins (if applicable).
  • Any custom CMS or third-party software.
  • Server-side technologies like PHP or MySQL, if possible.
• Remove unused or outdated plugins and themes to reduce attack surfaces.

5. Scan and Remove Malicious Code

• Use security tools to scan and clean your website:
  • Plugins: Wordfence, Sucuri Security, or MalCare for WordPress.
  • Online scanners: Sucuri SiteCheck or VirusTotal.
• Check manually for:
  • Unknown scripts or code injected into files like functions.php or .htaccess.
  • Suspicious files in your directories (e.g., files with random names or extensions).
• Delete or replace infected files with clean backups.

6. Restore Your Website

• Restore from a Clean Backup:
  • Use a backup taken before the attack to restore your site.
  • Test the backup on a staging environment to ensure it is clean.
• No Backup Available?:
  • Manually clean the infected site or hire a professional for assistance.
  • Consider rebuilding your website if recovery is impossible.

7. Improve Your Website's Security

Implement the following measures to prevent future attacks:

1. Install a Security Plugin:

   • Use plugins like Wordfence, Sucuri Security, or iThemes Security for real-time protection.

2. Enable Two-Factor Authentication (2FA):

   • Require 2FA for admin and user accounts using tools like Google Authenticator.

3. Limit Login Attempts:

   • Restrict the number of login attempts to prevent brute-force attacks.

4. Enforce HTTPS:

   • Install an SSL certificate and redirect all traffic to HTTPS.

5. Regular Backups:

   • Automate backups with tools like UpdraftPlus, JetBackup, or BackupBuddy.

6. Restrict File Permissions:

   • Set secure file permissions (e.g., 644 for files and 755 for directories).

7. Disable File Editing in WordPress:

   • Add this line to your wp-config.php file:

     define('DISALLOW_FILE_EDIT', true);
     ​

8. Harden .htaccess:

   • Block access to sensitive files like wp-config.php:

     <Files wp-config.php>
         order allow,deny
         deny from all
     </Files>
     ​

8. Monitor Your Website Regularly

• Use tools like:
  • Google Search Console for security alerts.
  • Sucuri SiteCheck for regular scans.
  • WP Activity Log to track user activity.
• Schedule periodic security audits to detect vulnerabilities.

9. Inform Your Visitors

• If personal information or sensitive data may have been compromised:
  • Notify affected users promptly and explain the actions you’ve taken to secure the site.
  • Be transparent to maintain trust with your audience.

10. Additional Precautions

1. Whitelist IPs for Admin Access:

   • Restrict access to your admin panel (wp-admin or equivalent) to trusted IP addresses.

2. Disable XML-RPC:

   • Unless necessary, disable XML-RPC to block brute-force and DDoS attacks.

3. Regular Training:

   • Educate your team on security best practices, such as identifying phishing attempts and maintaining strong passwords.

Conclusion

Recovering from a hacked or defaced website can be challenging, but acting quickly and systematically can mitigate damage and restore functionality. By following this checklist, you can:

• Assess and repair the damage.
• Implement robust security measures to prevent future attacks.
• Regularly monitor and maintain your site’s security to protect your data and reputation.

Proactive measures, like using strong passwords, enabling two-factor authentication, and scheduling backups, will go a long way in keeping your website safe. If needed, consider professional help to ensure a thorough recovery.