Restoring a Hacked Site

There are no known security vulnerabilities in our software, but website hacks are becoming more and more common, so we’ve created this page to help you understand the issue and to provide tips on restoring a hacked site.

Note

For the purposes of this document we use the term “hacker” to refer to a malicious user who is intent on gaining illegal access to a computer system or network by bypassing or breaking the security system.

How hackers get in

Almost all website hacks these days are automated. Rather than sitting in front of a computer, hackers use automatic scripts to scan thousands of websites an hour for known security vulnerabilities and weaknesses.

The top ways a hacker compromises a website are:

1. Exploiting known vulnerabilities in older versions of popular web scripts such as WordPress, email forms, image galleries, etc.

   • Open-source and free scripts are very common and installed on millions of servers, making them an easy target for hackers.
   • These scripts usually have common URLs and filenames (such as wp-login.php) that hackers can scan for.
   • Even if the script isn’t used, or was installed by default by the host, it can still be vulnerable.

2. Guessing easy passwords. Vulnerable passwords are usually short, simple, common, or dictionary words.

   • Automated scripts can test thousands of passwords a minute.

3. Compromising another account on a shared-hosting server and using it to gain access to other sites on the server, including yours.

   • This shouldn’t be possible if your web host has applied all the latest security patches and updates.
   • If you are repeatedly hacked and you believe it’s related to the host, there’s nothing you can do but switch hosts (or servers).

Once a hacker gains access to your site through one of the methods described above, they may then have all the same security rights as you do when you connect with FTP, or as PHP does (read/write files and the database, install programs, send emails, etc.), and in some cases may be able to gain full control of the server with administrator rights.

What they do once they’re in

Typically, once they have control of a website (and remember, most of this is done automatically) they will do the following:

• Install additional programs and backdoors to make it easier to control your server.
• Use your server to send bulk unsolicited email (spam).
• Use your server to attack other servers and websites and gain control of them.
• Redirect incoming links from Google and search engines to other websites.
• Display spam links on your 404 “Not Found” pages.
• Insert links or spam into your pages.
• Use the hijacked website to attempt to gain further access to your network or your web host’s network.

Hackers will want to use your server for as long as possible without being discovered, so often spam links will go undetected for some time and will only appear on pages you are unlikely to see, such as “404 Not Found” pages or pages that aren’t linked to from search engines.

How it can affect your site

Even if the changes are hard to detect or minimal, they can have a very negative effect on your traffic, website revenue, and reputation. Some examples include:

• You can lose traffic (search engines and anti-virus programs may block your website).
• You can get banned by Google if your site is hosting malware.
• You can get banned by email gateways if your site is sending spam.
• You can lose customers or reputation if website visitors see anti-virus warnings, viagra links, pornography, malware, etc.
• Your search engine ranking can be reduced, or you may be removed from search engines altogether.
• Your site may go slower or have decreased performance if server resources are being redirected for other purposes.
• You may exceed site quotas for bandwidth and CPU time and/or get charged overage fees.

Recovering and restoring your website

Recovering from a hacking attack takes time and effort. Use the following tips as a starting point:

1. Scan your local computer

   • Install an anti-virus program if you don’t have one.
   • Run a full anti-virus/malware scan. Sometimes exploits can be introduced from a compromised local PC.

2. Back up the hacked site

   • Back up your MySQL databases and any website files to your computer, labelling them as a hacked backup.
   • If you can still log in to CMS Builder, Admin Menu > Backup & Restore > Website Backup creates a full-site zip (website files, data folder, and a database dump) in one step.
   • This will allow you to restore to the previous version if your cleaning or upgrade attempts fail.

3. Contact your web host

   • Find out if other sites have been hacked (especially if you are using shared hosting).
   • Ask if they have any backups of your database or website files.
   • Find out if they have any tips or services for restoring hacked sites.

4. Restore from backup or clean infected files

   • If you have a clean backup of your files that has not been hacked, consider restoring to this backup.
   • Failing that, you will need to manually review and compare all files to find exploited or modified code.
   • CMS Builder’s audit log (Admin Menu > Audit Log) records logins (including failed attempts, with source and username) plus admin actions, and is worth reviewing for unauthorized activity.
   • One method to quickly replace program files is to upgrade or re-install your web applications.

5. Remove unneeded applications, files, or plugins

   • If you don’t think you need an application or file, remove it.
   • Make sure your files were backed up in an earlier step so you can restore any file that has been accidentally or incorrectly removed.

6. Upgrade all remaining applications and plugins

   • Make a list of all the applications and plugins on your site and their current versions.
   • For each application or plugin, download the latest version and install it.

7. Change all your passwords

   • Make a list of all your passwords.
   • Change all your passwords for FTP, email, control panels, MySQL, etc.
   • CMS Builder checks new passwords against a list of the most common passwords and rejects any that appear on it, but you should still choose long, unique passwords.

8. Final steps

   • Review Security Settings (Admin Menu > Advanced Settings > Security Settings) in CMS Builder. Enabling Require HTTPS, login timeouts, and Restrict IP Access helps prevent future compromises.
   • PHP errors and warnings are automatically logged to CMS Builder’s Developer Log, with optional admin email alerts. Injected or broken code often surfaces there.
   • Review the reference links below.
   • Do some online reading to find out more about best practices for restoring after a hack.
   • If you continue to have security problems, consider hiring a security professional to assist you.

Reference

Search engines

• Google Developers — Webmasters: Help recover a site that was hacked

Web hosts

• DreamHost — Hacked sites overview
• GoDaddy — My website was hacked. What should I do?
• SiteGround — Help! My site has been hacked!
• Bluehost — How to handle a hacked domain?

Web software

• WordPress FAQ — My Site was Hacked
• Joomla — You have been hacked/defaced?
• Drupal — My site was defaced (“hacked”). Now what?
• Zen Cart — Recovering From Hacks