How to Recover From a WordPress Website Attack

Jun 06, 2019 Web Developer Advice & Guides, Ask the Expert 0

---

 

So your WordPress website was attacked. What next?

Every website is vulnerable to most forms of internet and cyber attacks. Not only is a website attack stressful, but it also impacts heavily and negatively on business and readership.

When your WordPress website is attacked, chances are you will lose your entire site data as well as your search engine rankings. In addition, your reputation may be damaged if your website starts redirecting visitors to illegal or bad neighbourhood sites.

It is possible, however, to successfully recover from such attacks. Here’s how.

• Remain calm and locate the attack

The first thing to do in the case of a website attack is to remain calm and find the hack. There are signs to know when your website has been attacked:

• WordPress website marked as insecure by Google
• Sudden traffic spikes
• Website containing strange or illegal links
• Website redirecting to other sites
• Inability to login to your site as an admin
• Warning from browser or security plugin
• Website is taken offline by webhost

There are tools you can use to scan your site for malware. Alternatively, you can locate the hack by comparing the current state of your site with a recently updated backup if you have one.

• Contact your web hosting company

You must inform your web hosting company about the attack immediately. They are highly experienced in website attacks and will give appropriate guidance. They can also give additional details about the hack which you ordinarily wouldn’t have access to. It is advisable you use hosting companies of good repute like Bluehost, HostGator and Domains4Less Web Hosting.

• Hire a professional

If you’re not tech-savvy, you should hire a professional to take care of cleaning your website after an attack. Attempting to do things yourself may end up worsening the situation. A professional has the knowledge and experience to get your WordPress website back in good shape and protected from future attacks.

A good option for such professionals is Malcare. They are a WordPress security solution that will ensure your website is protected and accessible to your visitors in due time.

• Remove the hack

As soon as you discover the location of the hack, it needs to be removed immediately to prevent possible spread and contamination of other files. Removing the hack involves:

• • Cleaning hacked website files: Infections not in the plugins or core files can be fixed manually. Custom files can be replaced with new copies or an updated backup.
  • Cleaning hacked database tables: Using tools such as Adminer and Search-Replace-DB, you can remove a malware infection from your website database.
  • Securing user accounts: Remove any suspicious user accounts and change the passwords of any compromised user accounts. It’s recommended that you leave only one admin user account to reduce the chances of infiltration and completely remove any leftover invisible accounts.
• Removing malware warnings
• Removing hidden backdoors: Most hackers leave a backdoor behind which they can use to enter again. They sometimes do so using outdated files to access your website. They usually include the following PHP functions:
• move_uploaded_file
• eval
• preg_replace (with /e/)
• stripslashes
• assert
• system
• exec
• gzuncompress
• str_rot13
• base64

Be sure to test any changes however before removing any functions as they could also be used legitimately by plugins. You also need to have a WordPress security audit log plugin that’ll keep you informed of any changes that occur on your website.

• Restore backup

If you backup regularly, you may be able to fix your website attack easily by restoring it to a recently saved point before the attack. This, however, could mean losing valuable content created since the last backup, in which case it may be better to try removing the hack manually. Weigh your options critically and choose the better course of action.

• Change passwords

You need to ensure that all passwords for all users and accounts are changed again. This is an extra security measure that must be taken. Also, ensure that you use strong passwords.

• Double check user permissions

Double check user permissions of all your WordPress users. Ensure that no permissions have been tampered with. Ensure that only you and your team members have admin access. Remove any suspicious or unrecognised users.

• Change security keys

WordPress security keys or SALTs, as they’re called, are secret keys that encrypt information inside cookies. They help to increase the security of your WordPress websites by making it hard for hackers to crack your passwords.

Other security measures include:

• Disable PHP execution in certain directories
• Password-protect your admin directory
• Limit WordPress login attempts
• Disable plugin and theme editors
• Switch to managed WordPress hosting
• Setup a firewall and monitoring system

Conclusion

Having your WordPress website attacked is unpleasant and can be stressful. However, it’s also an opportunity to tighten up your site security against future attacks.  

---

---

---