What to Do If Your Site Is Hacked

A compromised website needs three things in order: contain it, find out how they got in, then rebuild it clean. Doing those out of order is how sites get reinfected within a day.

Work through this page from the top. It assumes nothing about how the attack happened.

Do not simply delete the suspicious files and carry on. Almost every compromise leaves more than one way back in: a second backdoor, a rogue administrator account, a scheduled task, or a modified core file. Removing the visible symptom and stopping there is the most common reason a site gets hit again the same week.

Signs You Are Actually Compromised

Search results show pharmaceutical, gambling, or foreign-language pages you never wrote.
Visitors are redirected elsewhere, often only on mobile or only from search engines.
A browser or search engine shows a warning for your domain.
Files appear with names or modification dates you cannot account for.
Your site sends spam, or your domain starts being rejected by mail providers.
An administrator account exists that nobody created.

Not every one of these means a hack. A site that is merely slow or throwing errors is more often a plugin conflict or a resource limit. See Website Not Loading first if that is all you have.

Step 1: Contain It

Take the site offline before you investigate. Every minute it stays public is more damage to your reputation, your search ranking, and your visitors.

The fastest way to do that without deleting anything is password protection, which puts a login in front of the whole site at the web server level:

Go to Websites and open the site.
Open the Password protect tab.
Enable it and set a username and password.

The site now returns a prompt to every visitor including the attacker, while you keep full access through the panel, SFTP, and SSH.

The site Security tab in KPanel showing the malware scan, IP block list and protections

If you know the attacker's IP address, add it to the IP block list on the site's Security tab as well.

Do not delete the site, and do not restore anything yet. The current state is your only evidence of how the attack worked. Take a backup of the compromised site now, label it clearly as infected, and keep it somewhere separate. You may need it.

Step 2: Work Out How They Got In

There are only a few realistic answers, and each one changes what you do next.

Check the panel audit log. Go to Settings, then Account, then View log. Actions attributed to your team from an IP address none of you use mean your Kapsule account itself was reached. That is a much bigger incident: see Account Security and treat the account as compromised too. The site's Activity tab covers changes made through the panel.

Check your error and access logs on the site's Logs tab. Repeated requests to a single plugin path, or a burst of POSTs to an upload endpoint, usually names the way in. See Reading Error Logs.

Run a malware scan on the site's Security tab. See Scanning For and Removing Malware for how to read the result.

Check what was out of date. An outdated plugin, theme, or core version is by far the most common entry point. See Keeping WordPress Updated.

Step 3: Rebuild Clean

There are two ways to end up with a clean site, and only one of them is reliable.

The Reliable Way: Restore From a Backup Taken Before the Compromise

Work out roughly when the compromise started from your logs, then restore from a backup taken comfortably before that date.

Go to the site's Backups tab.
Pick a backup from before the infection.
Restore it to staging first. The restore dialog defaults to staging deliberately.
Check the staging copy: no unknown files, no unknown admin users, no redirects.
When you are satisfied, restore to live. Restoring to live requires you to type the domain name to confirm.

See Restoring From a Backup for the detail, including how to restore files and the database separately.

On WordPress and WooCommerce sites with managed databases, point-in-time recovery on the site's PITR tab can restore the database to a specific minute rather than to the last nightly backup. That matters when you would otherwise lose a day of orders.

A restore rolls back everything, including legitimate content and orders created after that backup was taken. Before restoring, export any data you need to keep from the current site, and be aware that exported content from a compromised site can itself carry injected code. Inspect it before importing.

The Unreliable Way: Cleaning In Place

If you have no clean backup, you have to clean the site by hand. Be honest with yourself about how thorough this needs to be.

Quarantine every file the malware scan flags. See Scanning For and Removing Malware.
Replace WordPress core, every plugin, and every theme with fresh copies from source rather than updating in place.
Delete any plugin or theme you do not actively use. Inactive code still executes when it is reachable.
Inspect files the scanner does not cover: .htaccess, wp-config.php, and anything in your uploads folder that is not an image.
Check scheduled tasks on the site's Cron jobs tab for jobs you did not create.
Check the database for injected content, particularly in options and post content.

Step 4: Change Every Credential

Assume everything the site could reach has been taken.

WordPress administrator passwords. Reset every one from the site's WordPress tab, force every user to sign out so stolen session cookies stop working, and delete any application passwords you did not create. See Resetting a WordPress Password.
Unknown administrator accounts. Delete them, and demote any account that does not need administrator rights.
Database credentials, on the site's Database tab.
SFTP accounts on the site's SFTP tab. Deleting one terminates its open sessions.
SSH keys on the site's SSH access tab. Remove any key you do not recognise.
Your Kapsule password, and revoke any API keys you did not create. See API Keys and Developer Access.

Step 5: Bring It Back and Harden It

Once you are confident the site is clean, turn off password protection and let the world back in.

Then close the door that was open:

Keep everything updated. See Keeping WordPress Updated and Managing Plugins.
Turn on the security protections on the site's Security tab: brute-force protection, country filtering, and the IP block list.
Enable two-factor authentication on your Kapsule account and on the site's own administrator accounts.
Take a fresh backup of the known-good site. See Taking a Backup.
Consider extended backup retention, so a compromise you do not notice for weeks is still recoverable.

When to Involve Support

Open a support ticket if any of these apply:

The compromise came through your Kapsule account rather than the site.
Your site is sending spam, or your sending reputation has been affected.
You have no usable backup and cannot get the site clean.
Your account or site has been suspended. See Why Your Account Was Suspended.
You believe another customer's site is attacking yours. See Reporting Abuse.

Include what you found, when you first noticed it, and what you have already changed. The more of your own investigation you can share, the faster the answer.

Troubleshooting

Search engines still warn about the site. Request a review through their own webmaster tools once the site is genuinely clean. That is outside our control.

It came back after I cleaned it. You missed a backdoor, or a credential you did not change is still valid. Restore from a clean backup instead, and change every credential in Step 4.

The scan says clean but the site is clearly compromised. File scanning catches known malicious code, not injected database records. Compare against a backup and check the database.

I cannot get in to fix it. Use SFTP or SSH rather than the application's own login, which the attacker may have changed. See SFTP Access and File Manager.