What to do if your website is compromised

A compromised site gets worse the longer it runs. Work through these steps in order, and tell us early rather than after you have tried everything.

Signs your site is compromised

• Pages you did not create, often selling something unrelated.
• Visitors redirected somewhere else — sometimes only from search results or only on mobile.
• Search engines or a browser warning that the site is dangerous.
• Admin users you do not recognise, or your own admin password no longer working.
• A sudden spike in outbound email, or your domain suddenly landing in everyone's spam folder.
• Files quarantined by the malware scanner that you cannot account for.

1. Tell us straight away

Open a ticket from the Support section of your dashboard, set the priority to reflect the urgency, and pick the affected service. Include: the domain, what you are seeing, when you first noticed it, and anything you have already changed. If you would rather start on WhatsApp, message us and ask for a human — a real person can pick the conversation up from Ceda at any point.

Telling us early matters. A compromised site on shared hosting can affect neighbours, get the server's IP listed for spam, and burn your domain's sending reputation — all of which are far cheaper to prevent than to undo.

2. Change the credentials, all of them

• Your myPandos account password, from Profile → Security at dash.mypandos.io. Changing it signs you out of your other devices and removes remembered (trusted) devices, which is exactly what you want here.
• Your Plesk password.
• Your CMS administrator password, and remove any admin account you do not recognise.
• Your database user passwords, and update your application's configuration to match.
• Any FTP/SSH credentials, and any API keys the site uses.

Also check the computer you administer the site from. Stolen credentials often come from malware on a laptop, not from the server.

3. Contain it

If the site is actively serving malware or spam, taking it offline temporarily is better than leaving it up. A maintenance page costs you a day of traffic; a blacklisting costs you months of reputation.

4. Restore from a known-good backup

Restoring is usually faster and more reliable than trying to clean an infected site by hand. Choose a backup from before the first sign of trouble — see Hosting and VPS backups and restores. Restore, then immediately apply step 5 before putting the site back online, or you will be reinfected through the same hole.

5. Close the way in

• Update the CMS core, every plugin and every theme.
• Delete unused plugins and themes entirely.
• Remove anything you installed from an unofficial source — nulled and pirated extensions are a leading cause of compromise.
• Check file permissions are not world-writable.

6. Look for what the restore did not remove

If you cleaned rather than restored, check for: unknown administrator accounts, scheduled tasks (cron jobs) you did not create, a modified .htaccess, PHP files sitting in an uploads folder, and injected code at the top of index or header files.

7. Check DNS, email and your domain

Review the domain's DNS records for entries you did not add, check for mail forwarding rules you did not create, and confirm your domain's registrant contact details and lock status are still correct in your dashboard.

8. Rebuild trust

Once it is clean, request a review from any search engine or browser that flagged the site. If your domain was used to send spam, expect deliverability to take a while to recover — ask us and we will tell you what we can see from the server side.

What we can help with

We can check the server-side picture you cannot see: what the malware scanner found, what is in the logs, whether the server IP is listed, and which backups are available to restore. We will always tell you honestly what we can and cannot do for your specific service.