Home Forums Archived Forums Website hacked, I need help removing hacked code Reply To: Website hacked, I need help removing hacked code

#67600
Weaver
Keymaster

IF a site is hacked, there are usually extra files added to the site file structure, or existing files modified.

I you are not using a security plugin such as WordFence, and your site is still accessible from the admin page, you could try loading that plugin and have it scan your site. It is very good at detecting stray files (hacks), and being sure the rest of the files match the contents of those from WordPress.

Another thing to do is to use your cPanel or site tools from your hosting account, and look at the dates on all the files. You can often see files with creation or change dates that are after the date you first noticed the hack. If you find stray files, often just deleting them will undo the hack.

You want to get this fixed asap since if Google detects your site has been hacked, it will block it from being accessed. (Google seems to find hacked sites the fastest, and may only block it on Chrome, but there are other security bots looking for hacked sites and have other ways to block them.) Once you’ve been blocked, it can literally take months to get your site unblocked. I had that happen to one of the sites I run, and had to duplicate the site under a different domain, and use a very tiny .html file to forward the old site to the alternative. It was months before we could return to the actual original site, and it was very very hard to get Google to un-blacklist our site.

Otherwise, the only solution is to have your host completely restore the site to its state right before you noticed the hack. Then you might have to hand restore stuff.

Then be sure to have WordFence (the one I use, there are others) running a daily scan on your site.