My Website Was Hacked: What to Do First

If you suspect your website has been hacked, don't panic, but act quickly. The first priority is to stop further damage: lock down access, find out what was changed, and clean or restore your site before you worry about anything else.

Signs Your Website May Be Compromised

• Your website shows content you didn't add, or redirects visitors to another site
• Google or your browser shows a "Deceptive site ahead" or "This site may be hacked" warning
• You notice files, folders, or admin accounts you don't recognize
• Your hosting account is suddenly sending large volumes of spam email
• Your account has been suspended for abuse or resource overuse you didn't cause

Step 1: Lock Down Access Immediately

Before anything else, change every password connected to your hosting account. Attackers who got in once will try to get back in the same way.

1. Change your control panel password (cPanel or DirectAdmin)
2. Change your FTP account password(s)
3. Change your MySQL database user password(s)
4. Change the admin password of any CMS (such as WordPress) or app installed through Softaculous
5. Change your email account passwords if any were used to send spam

If you run WordPress specifically, see our dedicated guide: My WordPress Site Was Hacked: What to Do First for CMS-specific cleanup steps.

Step 2: Scan Your Account for Malware

In cPanel

Open ClamAV Virus Scanner from your cPanel dashboard and run a full scan of your home directory. Review any files it flags before deciding whether to quarantine or delete them.

In DirectAdmin

Open the ClamAV Antivirus tool from your DirectAdmin dashboard and scan your domain's directories. Flagged files are moved to quarantine, where you can review them individually.

For the full walkthrough of running and reviewing a scan, see How to Scan Your Website for Malware Using ClamAV.

Step 3: Look for Unauthorized Changes

• Check Cron Jobs for entries you didn't create
• Check your .htaccess file for rules you didn't add, especially unfamiliar redirects
• Check your FTP accounts and email accounts lists for ones you don't recognize
• If you run WordPress or another CMS, check the admin users list for accounts you didn't create

Step 4: Clean Up or Restore From a Backup

If the infection is small and you know exactly which files were changed, you can delete or replace just those files. If the damage is widespread, or you can't be sure everything is clean, restoring from a backup taken before the compromise is safer and faster.

Both control panels let you restore a full account backup or a single file. Check your account's available backups first, since restoring overwrites the current state of your site.

Step 5: Harden Your Account Against Repeat Attacks

1. Update your CMS core, themes, and plugins (or any Softaculous-installed app) to the latest versions
2. Enable two-factor authentication for your control panel login
3. Enable brute-force login protection if it isn't already on
4. Review your control panel's login history for any unfamiliar IP addresses or login times

Once your site is cleaned and hardened, keep an eye on it for a few days afterward: recheck your scan results, watch for any new spam complaints, and confirm visitors no longer see a security warning before you consider the matter closed.