Recovering a Website After a Security Incident

Recovering a Website After a Security Incident

Discovering that your website may have been compromised can be worrying, but the first thing to do is remain calm. Acting too quickly can destroy useful evidence, remove your only recoverable copy, or make the website more difficult to clean.

Most compromised websites can be recovered. The important steps are to contain the incident, restore or rebuild the website from a clean source, close the route used by the attacker, and carefully check the website before returning it to normal use.

This guide provides practical recovery steps for WordPress and non-WordPress websites hosted by Hipposerve.

Signs That a Website May Have Been Compromised

Possible signs of a compromised website include:

• Unexpected pages, posts, files, or administrator accounts.
• Visitors being redirected to another website.
• Unfamiliar pop-ups, advertisements, or downloads.
• Security warnings from browsers or search engines.
• Antivirus software reporting malicious content.
• Unexpected changes to the website’s appearance or content.
• Unusual email, storage, traffic, or resource usage.
• Login details suddenly no longer working.
• Customers reporting suspicious behaviour.

Not every error or unavailable website is caused by an attack. A failed update, plugin conflict, expired domain, DNS problem, or application error can produce similar symptoms. Record what you have seen and when it started before making major changes.

Take Immediate Precautions

Before beginning the recovery:

1. Take screenshots and record the suspicious behaviour, affected pages, warning messages, and approximate time it was discovered.
2. Avoid editing or deleting individual files unless you understand their purpose.
3. Do not use a computer that you suspect may contain malware.
4. Run a security scan on the computers normally used to manage the website.
5. Change your Hipposerve and website-administrator passwords from a trusted device.
6. Enable two-factor authentication wherever it is available.
7. If visitors could be placed at risk, consider temporarily placing the website into maintenance mode or restricting public access.

If the website processes payments, stores personal information, or supports an important business service, consider obtaining professional assistance before making changes.

Choose a Clean Restore Point

Hipposerve® Rewind allows you to restore your website from an earlier backup. Seven days of backup history are included as standard with eligible hosting plans. Extended options of 30, 180, or 365 days may also be available.

Choose the most recent backup that you reasonably believe was created before the website was compromised.

Remember that an attacker may have gained access days or weeks before the problem became visible. Malicious code can remain inactive before it is triggered, so the newest available backup may not always be clean.

For restoration instructions, see Restoring Your Website.

Before Restoring the Website

Simply copying a backup over an infected website may not remove malicious files that were added after the backup was created. For a clean restoration, the existing website files and affected database should normally be removed before the known-clean backup is restored.

Warning: Removing website files or a database is destructive. Before proceeding:

• Confirm that a suitable backup is available and can be restored.
• Confirm that you have selected the correct website and database.
• Preserve a copy of the compromised website if it may be needed for investigation.
• Export any recent legitimate orders, enquiries, posts, or customer data that must be retained.
• Do not delete email accounts, domains, DNS records, or unrelated databases.
• Ask Hipposerve or a website professional for help if you are uncertain.

Once the backup and correct website have been confirmed, remove the compromised website files and clear or replace its affected database before starting the restoration.

This prevents malicious files that were not present in the clean backup from remaining in the hosting space after the restore.

Recovering a WordPress Website

Hipposerve® WordPress Manager can help you manage and recover a WordPress installation without relying entirely on the WordPress administration area.

For an introduction to the available tools, see Hipposerve® WordPress Manager.

Restore WordPress From a Clean Backup

1. Confirm that you have selected the correct WordPress installation.
2. Confirm which backup is believed to be clean.
3. Preserve any information required for investigation or business records.
4. Remove the compromised WordPress installation, including its files and affected database.
5. Restore the selected backup using Hipposerve® Rewind.
6. Check that the restored website loads correctly.

If you are not confident about removing and restoring the installation, stop and contact Hipposerve support or an experienced WordPress professional.

Update WordPress, Plugins, and Themes

A restored backup may contain the same outdated component that allowed the website to be compromised. Update the website immediately after restoring it and before returning it to normal use.

• Update the WordPress core to the latest supported version.
• Update every installed plugin.
• Update all installed themes.
• Remove plugins and themes that are no longer required.
• Remove abandoned plugins or themes that are no longer maintained.
• Replace unauthorised, modified, or “nulled” premium software.

You can perform these updates using Hipposerve® WordPress Manager or by signing in to the WordPress dashboard.

For further guidance, see Managing Your WordPress Plugins.

If a paid plugin or theme licence has expired, updates may no longer be available. You may need to renew or repurchase the licence from the original developer.

Review WordPress Users

Check every user account registered on the website, paying particular attention to administrators.

• Remove administrators you do not recognise.
• Remove accounts with unexpected or unusual names.
• Remove accounts belonging to former employees, developers, or contractors who no longer require access.
• Reset the passwords of all remaining administrators.
• Use strong, unique passwords.
• Enable two-factor authentication for administrators wherever possible.
• Give users the lowest level of access required for their work.

Important: Before deleting an unfamiliar user, check whether it belongs to a current developer, agency, integration, or legitimate service.

End Existing WordPress Sessions

Changing a password does not always end every existing session immediately. After cleaning the website, sign out active WordPress sessions and rotate the WordPress security keys and salts in the wp-config.php file.

This helps invalidate existing login cookies and removes access from users who may still have an active session.

If you are unfamiliar with editing WordPress configuration files, ask an experienced WordPress professional for assistance.

Scan the WordPress Website

Install a reputable malware-scanning plugin, such as Wordfence, and run a complete scan of the website.

• Review every warning produced by the scan.
• Repair or replace modified WordPress core files.
• Replace suspicious plugins and themes with clean copies obtained from their original developers.
• Remove unknown files and code only after confirming that they are not legitimate.
• Run another complete scan after completing the cleanup.

A scanner can help identify suspicious files, but no automated scanner can guarantee that every backdoor or database modification has been removed.

Hipposerve® Sentinel provides protection at the server level, so configuring an additional plugin firewall is not normally necessary. The malware-scanning and file-checking features can still be useful during an investigation.

Check Important WordPress Files and Settings

If you or your developer are performing a detailed inspection, pay particular attention to:

• The wp-config.php file.
• The .htaccess file.
• Active theme files.
• The WordPress uploads directory.
• Must-use plugins and unfamiliar plugin directories.
• Unexpected scheduled tasks.
• Unknown database administrators or modified website addresses.
• Unexpected redirects or injected scripts.

Where possible, replace WordPress core files, plugins, and themes with clean copies from their official sources rather than attempting to repair unknown code manually.

Reapply WordPress Security Measures

Once the website is clean and fully updated, use Hipposerve® WordPress Manager to review and reapply the recommended WordPress security measures.

Test the website afterwards, particularly its forms, checkout, membership, booking, and administration features.

Recovering a Non-WordPress Website

If your website uses another content-management system, an e-commerce package, a framework, or custom code, the overall recovery process is similar.

1. Record the signs of compromise and preserve any useful evidence.
2. Identify the most recent backup believed to be clean.
3. Confirm the backup before removing any data.
4. Remove the compromised website files and affected database.
5. Restore the website from the clean backup or redeploy it from a trusted source.
6. Update the application and all its components.
7. Change all related passwords and credentials.
8. Test and scan the website before returning it to normal service.

Update the Website Application

After restoring a non-WordPress website, update all software used by the application.

• Update the content-management system or e-commerce platform.
• Update modules, extensions, packages, themes, and templates.
• Update programming frameworks and software dependencies.
• Use a supported version of PHP or any other required server software.
• Remove old applications, development copies, test files, and unused components.
• Replace files with clean versions from trusted sources wherever possible.

If the website uses custom code, ask its developer to review it for vulnerabilities. Restoring the files without fixing the original weakness may allow the website to be compromised again.

Review Non-WordPress Users and Access

Review every account and access method associated with the website.

• Remove unknown or unnecessary administrator accounts.
• Reset passwords for all administrators and authorised users.
• Change hosting, database, FTP, SFTP, email, and application passwords.
• Rotate API keys, access tokens, webhook secrets, and other credentials.
• Review scheduled tasks and automated integrations.
• Check whether developers or former staff still have access.
• Enable two-factor authentication wherever it is available.

Change credentials from a trusted device. If a computer used to manage the website is infected, newly created passwords could also be compromised.

Check the Database and Configuration

A compromised website may contain malicious changes in its database as well as its files.

Check for:

• Unknown administrator or customer accounts.
• Unexpected scripts inside pages, posts, templates, or settings.
• Modified website addresses or redirect settings.
• Unknown scheduled jobs.
• Unexpected API keys or integrations.
• Changes to payment, email, or form-delivery settings.
• New database users or altered database permissions.

If you are unable to determine which database content is legitimate, consult the website developer or a security professional.

Change Passwords Again After Cleaning

You may change passwords initially to contain the incident. Once the website has been cleaned and the devices used to manage it have been checked, change all important passwords again.

This should include:

• Your Hipposerve account.
• Website administrator accounts.
• Hosting and file-transfer accounts.
• Database accounts.
• Email accounts associated with the website.
• Third-party services and integrations.

Use a different, strong password for every account and enable two-factor authentication wherever possible.

Test the Recovered Website

Before returning the website to normal use, test:

• Public pages and navigation.
• Contact and enquiry forms.
• Customer login and account areas.
• Checkout and payment functions.
• Bookings, memberships, or subscriptions.
• Email delivery.
• Search and redirects.
• Connections to external services.
• Mobile and desktop layouts.

Run another malware scan after testing and continue to monitor the website closely for unexpected changes.

Check Search Engines and External Services

If a browser or search engine has marked the website as unsafe, cleaning the website may not remove the warning automatically.

• Check your search-engine management tools for security warnings.
• Request a review after confirming that the website is clean.
• Check whether the domain appears on relevant security or email blocklists.
• Review DNS records for unauthorised changes.
• Confirm that payment, analytics, advertising, and email integrations have not been altered.

Consider Whether Data Was Accessed

If the website stores customer information, personal data, payment information, health information, or other sensitive records, consider whether the attacker may have accessed or copied that data.

You may need specialist technical, legal, data-protection, or payment-industry advice. Keep a record of what happened, when it was discovered, the systems affected, and the steps taken in response.

If the Website Is Compromised Again

If the website is compromised again shortly after being restored, this may indicate that:

• The selected backup was already infected.
• The original vulnerability was not corrected.
• A malicious administrator account remains active.
• A password, computer, or email account is still compromised.
• A backdoor remains in the files or database.
• An insecure plugin, theme, integration, or custom application is still present.

Do not repeatedly restore the same backup without investigating the cause. Choose an earlier known-clean backup or obtain professional assistance.

When to Ask for Professional Help

Some compromises cannot be safely resolved using an automated scanner or a simple backup restoration.

Professional assistance is recommended when:

• No known-clean backup is available.
• The website is compromised again after restoration.
• Malware continues to reappear.
• The database contains unknown modifications.
• The website handles payments or sensitive information.
• Several websites or accounts are affected.
• You cannot identify how the attacker gained access.
• You are unsure whether the website is completely clean.

Your website developer or a specialist website-security professional may need to inspect and rebuild the application.

You can also contact the Hipposerve support team. Although application-level cleanup is not included with every hosting service, we may be able to help identify the problem, restore an available backup, or advise you on the next step.

After the Website Has Been Recovered

Once the website is clean and working normally:

• Keep the application and all components up to date.
• Enable automatic updates where appropriate.
• Remove unused users, plugins, themes, modules, and applications.
• Use strong, unique passwords and two-factor authentication.
• Review your backup-retention period.
• Check the website regularly for unexpected changes.
• Ask your developer to maintain any custom code.
• Document the incident and the steps taken to prevent it from happening again.

A successful restore returns the website to service. Identifying and correcting the original cause helps prevent the same incident from happening again.