Signs a Site Is Hacked and First Steps Without Destroying Evidence

Purpose of this article

This guide helps you recognize common signs of a compromise on WordPress, WooCommerce or PrestaShop and execute immediate, safe measures. The goal is to limit the attacker’s access, preserve evidence for later analysis, and prepare a clean restoration, without performing irreversible actions automatically.

Who this article is for

• Technical administrators or site managers.
• People with FTP/SFTP access, hosting control panel access and CMS admin interface access.
• Applicable to WordPress, WooCommerce (WordPress plugin) and PrestaShop 1.7–9 sites.

Prerequisites

• Access to a CMS administrator account (do not share the password via e-mail or chat).
• FTP/SFTP access or the host’s file manager.
• Access to the hosting control panel (cPanel, Plesk, etc.) if available.
• A recent, verifiable backup (if possible, do not restore immediately).
• Securantis license activated or ability to activate the plugin/module to run a scan.

Signs of infection (platform-independent)

1. Visitor-visible behavior

• Pages redirected to unrelated content (external redirections).
• Added content: aggressive ads, unknown forms, third-party iframes.
• Blank pages or 500 errors on public pages.

2. Admin-side activity

• Unknown administrator accounts or role changes.
• Unusual login failures or mass use of the password reset process.
• Appearance of extensions/modules/themes that were not installed.

3. Technical indicators

• Recently modified files (especially PHP files) that you did not change.
• New PHP files in media or uploads folders.
• Suspicious cron jobs, unknown scripts executed server-side.
• Mass e-mail sending from the domain.

4. Server and network signs

• Sudden high CPU, memory or I/O load.
• Outgoing traffic to unknown IPs or abnormal connections.
• Port scans or repeated attempts against wp-login / back office.

Immediate measures (without destroying evidence)

Important: do not run automatic deletion or overwrite suspicious files before collecting evidence.

Step 1 — Isolate but do not delete

1. Put the site into maintenance mode (static page) if possible to limit public impact.
2. If the WAF (firewall) is active, increase sensitivity to block abusive requests, but keep note of the logs.
3. Do not delete any suspicious files: place them in logical quarantine or mark them for review.

Step 2 — Collect evidence

1. Immediate full backup: database + files (download a copy off-server if possible).
2. Export web logs (access.log, error.log) and mail logs if available.
3. Note IP addresses that performed suspicious actions and capture timestamps.
4. If you have a scanner (Securantis), run a full scan: it will identify modified files, PHP in uploads, core integrity and WooCommerce anomalies. Securantis also records events and offers controlled quarantine — quarantine does not erase anything automatically: it is an action you choose.

Step 3 — Lock down access

1. Change all administrative passwords from a clean machine (CMS admin, FTP/SFTP accounts, database, hosting panel). Never send these passwords by e-mail or chat.
2. Revoke all active sessions in the CMS interface when possible.
3. Restrict admin area access by IP if your host allows it.
4. Enable or strengthen 2FA for all administrator accounts.

Step 4 — Prevent persistence

1. Disable unknown administrator accounts but keep their information (do not delete immediately).
2. Disable non-essential plugins/modules for analysis, noting each change.
3. Search for and note unknown cron jobs and startup scripts.

Expected outcome after these measures

• The site exposure is limited publicly.
• You have a backup and logs necessary for analysis.
• The attacker’s initial access is locked (at least temporarily).
• Suspicious files are isolated without being destroyed.

Prudent settings

• Do not enable automatic deletion in the scanner: prefer manual quarantine.
• When restoring from a backup, check CMS, plugin and theme versions (do not restore a vulnerable backup without updating).
• Keep original logs for at least 30 days for analysis.

Common mistakes to avoid

• Deleting without backing up: removes a key point of analysis.
• Restoring an old backup without fixing the root cause: the attacker may reuse the same vulnerability.
• Sharing passwords via e-mail/chat or creating an unsecured external access for a contractor without a contract.

Common troubleshooting

• Securantis scan returns many files marked "suspicion de PHP dans uploads": do not delete them automatically; download these files and analyze their header and date, quarantine them and request manual analysis if unsure.
• 500 errors after disabling a plugin: re-enable them one at a time and check the PHP logs.
• Mass e-mails sent from your domain: change the SMTP/sending account password, suspend sending and analyze scripts that call the send function.

Legal and operational precautions

• Keep any change to the server state documented (who did what, when).
• Do not erase logs before making a copy.
• If customer data may have been exposed, check local legal obligations (notification to affected individuals, competent authorities).

When to contact Securantis support

Contact support if:

• You have an infection case and want an in-depth analysis providing a compromise report.
• The scanner identifies critical files but you do not know if deletion/restoration is safe.
• You suspect persistence (backdoor) but cannot find the origin.
• You need assisted intervention (access for a paid intervention must be provided via the secure client area after payment).

Information to provide to support (do not send passwords)

• Description of observed signs and date/time.
• Copies of web and security logs (compressed files if possible).
• Securantis scan results and list of files put in quarantine.
• Available backups (date and type).

Conclusion and best practices after resolution

• Immediately apply updates to the CMS, themes and plugins.
• Strengthen authentication (2FA) and restrict access by IP if possible.
• Implement continuous monitoring (regular scanner, WAF enabled, alerts).
• Schedule test restorations and maintain an off-site backup strategy.

If you need help analyzing a Securantis scan, preparing items for an intervention or planning a safe restoration, contact our support via the secure client area.