Locked and unlocked hacked websiteIt’s every webmaster’s worst nightmare – you show up to work in the morning and check your website only to find it’s been defaced by punks who think it’s funny to make your site look like an advertisement for the Nazi party. In other words, your site has been hacked. Here’s what you can do about it:
Preparation Starts Before an Attack Happens
Figuring out what to do if your site gets hacked actually needs to start before it happens. The very first thing you absolutely, positively must do as soon as your start building a site is to arrange for a backup. Ideally, this should be an offsite backup (i.e. if you backup onto the server and the server dies, your site goes with it).
Mind you, as I said above, this isn’t just about your website getting hacked. Computers die, there are fires and floods and all kinds of other horrible things that can happen to a computer (and in case you forgot, since it seems like your site is just somewhere out there on the Internet, your website is located physically on a computer somewhere).
You should contact the hosting company to find out how to do backups. For those running WordPress blogs, I highly a recommend a plugin I personally use called Automatic WordPress Backup which can backup your WordPress blog to Amazon S3. The plugin takes care of all the heavy lifting for you and makes it a breeze to recover once a disaster happens.
Contact Your Site Host
Okay, now that we have our backup, let’s get back to the nightmare scenario – your website has been hacked and you are desperately trying to figure out what to do about it. The first thing to do is to contact your site host and explain that you website has been hacked.
If they have a backup of their servers (many site hosts do), they may be able to restore your site in just a few minutes. If they don’t have a backup, you should have one (as above). Have them delete the hacked version of the site and arrange for a new password and possibly new user name on their system so you can re-upload your site.
Change Your Passwords
Next, whatever you do, make yourself a long, complicated password to prevent this from happening again. The password should not be easily guessable and ideally should use both upper and lower case as well as random characters.
For example (this is totally random, generated right now and not used anywhere): j743r0-];./8HT)(kt%opnY%fg5r2R. That would be an excellent password because it’s completely random, includes upper and lower case letters as well as numbers and other keyboard characters and is hard to guess. Just keep a copy in a safe place where you can find it when you need it again.
Double Check Security
Finally, if your site has been hacked, you’ll want to ask your site host to double check on security. Make sure that the problem happened because you made your password too easy to remember and not because they had a security breach on their end.