Cleaning a hacked site and closing the entry point

Cleaning Up a Hacked Website; From Panic to Taking the Right Action

When you realize your website has been hacked, the first reaction is usually panic and deleting the infected files. But if you proceed without a plan, you will both destroy the evidence and likely leave the attack vector open. Cleaning up a hacked website is a systematic process that must be done in order: isolate, backup, clean, change passwords, and finally close the vulnerability. In this article, we will go through exactly this path with practical commands and real examples.

Important note: If your website is on shared hosting and several other sites are on the same server, the risk of cross-contamination is high. In this case, first coordinate with the hosting support, and if possible, move the site to an isolated environment (VPS or a separate directory). ServerNet also offers secure hosting services that can be a good option in such situations, but the focus of this article is on the cleanup process itself.

Step One: Isolating and Cutting Off Access

The goal of this stage is to prevent the spread of infection and preserve evidence. If your site is on a Linux server with SSH, run these commands:

# Disable web access to the site directory
sudo a2dissite your-site.conf
sudo systemctl reload apache2

# Or if you have nginx:
sudo rm /etc/nginx/sites-enabled/your-site
sudo systemctl reload nginx

If you don't have SSH access (shared hosting), temporarily disable the site through cPanel or DirectAdmin, or replace the index with a maintenance.html page. This prevents visitors and search engines from accessing the infected content.

Initial Investigation: What Has Changed?

Before taking any action, review the file change history. If you use Git:

cd /var/www/your-site
git status
git diff --stat

If you don't have Git, find files that have been recently modified:

find /var/www/your-site -type f -mtime -7 -exec ls -la {} \;

This output shows you which files were changed during the hacking period. Usually, .php files in upload directories or themes are the primary targets.

Step Two: Backing Up the Infected Site

It may seem strange, but you should back up the infected site. Why? Because this backup is essential for malware analysis and identifying the attack pattern. If you later discover that the hacker had access to the database, this backup will be useful.

# Full backup of files
tar -czf /backup/compromised-site-$(date +%Y%m%d).tar.gz /var/www/your-site

# Database backup (MySQL example)
mysqldump -u root -p your_database > /backup/db-compromised-$(date +%Y%m%d).sql

Keep these backups in a secure location outside the server (e.g., on your personal system or cloud storage). After cleanup, if you need to analyze, you will use these files.

Step Three: Cleaning Files and Database

Now it's time for the main work. Cleaning up a hacked website involves two parts: files and database.

Cleaning Files

The best approach is to compare with the original version. If you have WordPress, compare the core with the official version:

# Download WordPress matching your site's version
wget https://wordpress.org/wordpress-6.5.3.tar.gz
tar -xzf wordpress-6.5.3.tar.gz

# Compare core files
diff -r wordpress/ /var/www/your-site/wp-admin/ | head -50
diff -r wordpress/ /var/www/your-site/wp-includes/ | head -50

Files that differ in the comparison or don't exist in the original version are suspicious. Do the same for themes and plugins with their official versions.

Common suspicious files:

• wp-content/uploads/ — PHP files that shouldn't be there
• wp-content/mu-plugins/ — hidden plugins not visible in the dashboard
• wp-config.php — extra code at the end of the file
• .htaccess — malicious rewrite rules

To delete definitively infected files:

# Delete PHP files in the upload folder (example)
find /var/www/your-site/wp-content/uploads -name "*.php" -delete

# Delete eval and base64 files that indicate malware
grep -rl "eval(base64_decode" /var/www/your-site --include="*.php" | xargs rm -f

Cleaning the Database

Hackers usually inject malicious code into theme options or post content. Search for traces with these queries:

-- Search for malicious scripts in content
SELECT ID, post_title, post_content 
FROM wp_posts 
WHERE post_content LIKE '%eval(%' 
   OR post_content LIKE '%base64_decode(%'
   OR post_content LIKE '%%';

-- Check theme options
SELECT option_name, option_value 
FROM wp_options 
WHERE option_name LIKE '%theme%' 
   OR option_name LIKE '%widget%';

If you find infected content, replace it with clean content or delete the post. For theme options, the best approach is usually to reset the theme to its default state.

Step Four: Changing All Passwords

After cleaning the files, you should assume all passwords have been compromised. Be sure to change the following:

1. FTP/SFTP and SSH passwords
2. Database password (and update wp-config.php)
3. WordPress admin password for all users
4. Email passwords associated with the domain (e.g., admin@yourdomain.com)
5. API keys and tokens for external services

To change the database password in MySQL:

ALTER USER 'wp_user'@'localhost' IDENTIFIED BY 'NewStrongPassword!2024';
FLUSH PRIVILEGES;

Then update the DB_PASSWORD value in wp-config.php.

Also, change the WordPress security keys. Get new keys from this address: https://api.wordpress.org/secret-key/1.1/salt/ and replace the values from AUTH_KEY to NONCE_KEY.

Step Five: Closing the Attack Vector

Cleaning without closing the vulnerability is useless. Hackers usually enter through these routes:

1. Outdated Plugins and Themes

Known vulnerabilities in outdated plugins are the most common attack vector. Update all plugins and themes to the latest versions. Remove plugins that are no longer supported.

2. Weak Passwords

If the site admin password was admin123, it's no surprise you got hacked. Use strong passwords and enable two-factor authentication (2FA).

3. Unauthorized Access to wp-admin

Restrict access to wp-login.php. In .htaccess, you can allow only specific IPs:

<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.100
    Allow from 203.0.113.5
</Files>

If you don't have a static IP, use a login attempt limiting plugin.

4. Reviewing Logs

Check server logs to find the attack pattern:

# Check Apache access log
grep "wp-login.php" /var/log/apache2/access.log | tail -20

# Search for POST requests to PHP files in the upload folder
grep "POST.*uploads.*\.php" /var/log/apache2/access.log | tail -20

These logs show where the hacker entered from. If you see a clear pattern (e.g., many requests to a specific file), close that entry point.

Restoring the Site and Continuous Monitoring

After complete cleanup and closing the vulnerability, reactivate the site. But the work isn't done. Monitor logs and files for a few weeks:

# Daily check for new files
find /var/www/your-site -type f -mtime -1 -exec ls -la {} \;

# Check changes to core files
md5sum /var/www/your-site/wp-config.php

Also, install a security plugin (like Wordfence or Sucuri) that scans files and reports changes.

Summary

Cleaning up a hacked website is a multi-step process that shouldn't be rushed. The correct order of tasks: isolate, backup, clean files and database, change all passwords, and finally close the vulnerability. If you do each step correctly, the likelihood of the hacker returning is minimized. Remember that security is an ongoing process, not a one-time action. Keep your site updated, use strong passwords, and regularly review logs.