Stay calm and follow an emergency plan
Panic leads to mistakes. Record the time and symptoms (defaced pages, redirects, unknown files, login lockdowns) and prepare to act methodically.
Preserve evidence
-
Take timestamped screenshots and download affected pages.
-
Export server, PHP and database logs if available.
-
Make a full forensic copy of the site and database and store it separately.
Preserved evidence helps incident analysis, remediation and legal reporting. Avoid overwriting original logs.
Immediately limit exposure
-
Put the site into maintenance mode or serve a static page if possible.
-
Change FTP/SFTP, SSH, database and hosting passwords from a known‑clean machine.
-
Revoke and regenerate exposed API keys and tokens.
-
Stop suspicious cron jobs or processes sending spam or making outbound connections.
Contact your host or an incident response professional
Your host can help isolate the account and provide logs. If unsure, engage a specialist for incident response to avoid missteps (Securantis can assist where relevant).
Use a clean machine for critical actions
Perform sensitive changes only from a patched, malware‑free workstation on a trusted network. Public Wi‑Fi and compromised devices will reset your progress.
Find the entry point
Investigate:
-
Logs for suspicious IPs, brute force attempts, and unusual routes.
-
Recently modified files and unexpected uploads.
-
For WordPress: check plugins/themes for known vulnerabilities, unauthorized admin users, and wp-config.php integrity.
-
For PrestaShop 1.7–9: inspect overrides, third‑party modules and settings.inc.php.
Don’t rush to delete files until you understand the attack vector; backdoors often persist.
Restore from a verified backup
-
Use a tested backup predating the compromise. Avoid backups that might contain the attacker’s code.
-
If possible, restore to a staging environment first and verify the vulnerability has been fixed.
-
After restoration, rotate all passwords and revoke sessions and tokens.
Fix the root cause and harden the site
-
Apply updates to CMS, plugins, themes and dependencies.
-
Remove unmaintained or insecure extensions.
-
Enforce multi‑factor authentication for admin accounts.
-
Implement least privilege on file permissions and user roles.
-
Deploy a WAF and rate limiting.
Monitor and communicate
-
Enable logging and continuous monitoring (file integrity, login alerts).
-
Notify affected users if personal data was exposed, complying with legal requirements.
-
Conduct a post‑incident review to improve processes and response.
Practical checklist
-
Screenshots and log exports
-
Site isolation (maintenance/quarantine)
-
Change credentials from a clean machine
-
Contact hosting provider or expert
-
Identify entry point
-
Restore from tested backup
-
Apply updates and remove risky plugins
-
Enable MFA and restrict permissions
-
Increase monitoring and run a post‑incident audit
Conclusion
Handling a hacked site requires discipline: preserve evidence, limit damage, restore from a clean backup, remediate the vulnerability and monitor closely. When in doubt, seek professional incident response. Regular backups, prompt updates and least‑privilege are your best preventive measures.