In the security world, the following advice seems to be gold: keep templates and plugins up to date; use secure passwords and captchas; be careful whom you give access and to what; use a security-conscious web host.<\/p>\n\n\n\n
While those are all great tips and we encourage them, your website is still (and always will be) hackable. We\u2019ve seen and helped clients with numerous hacks over the years, so we wanted to share some advice that goes beyond following security best practices.<\/p>\n\n\n\n
As your user base and reputation grow, getting hacked becomes more likely and it really can happen to anyone. Therefore, the best thing you can do is to have a hack recovery plan. In case of disaster, you\u2019ll know exactly what needs to be done, and who can do it for you. You won\u2019t panic and make hasty decisions that may turn a crisis into a catastrophe.<\/p>\n\n\n\n
You don\u2019t want to find out about a hack from a random visit to your own site. You don\u2019t want to see the red screen of death, with an unwelcoming message like \u201cDanger: malware ahead!\u201d or \u201cThis website may harm your computer\u201d. You don\u2019t want to see your homepage defaced (at the time of writing, a WordPress REST API Vulnerability<\/a> is at large and defacing thousands of websites).<\/p>\n\n\n\n The worst thing about finding a hack by accident is that you probably won\u2019t know how long it\u2019s been there. You won\u2019t be able to put the damage into perspective.<\/p>\n\n\n\n The solution is to set up one or several proactive tools that detect hacks and notify you.<\/p>\n\n\n\n Front-end\/Source Code Monitors<\/strong> Google Search Console Alerts<\/strong> You will need a backup copy of the hacked site to be used later when removing malicious code. Make a backup and save it before going into maintenance mode.<\/p>\n\n\n\n That being said, make sure your site is backed up regularly and several copies are kept at all times. A clean copy can also be of help when later recovering your site. Your web host will usually make backups for you, but there are plenty of tools and plugins to set up backups yourself.<\/p>\n\n\n\n Another thing to be used in the recovery of your site is access logs. Talk to your host whether they can provide them and how far back in time. Some attacks are difficult to find and may require logs from 6 months ago. If your host cannot provide that, set up log keeping yourself. At SiteGround, and probably other hosts, access logs can be downloaded from the Statistics tool.<\/p>\n\n\n\n Going into maintenance mode as soon as possible is important. Search engines constantly check the HTTP status of your site and what content it is serving to visitors. Having your site down<\/a> or serving malicious content will obviously damage your rankings.<\/p>\n\n\n\n This is why it\u2019s a good idea to have a simple HTML maintenance page ready before you ever get hacked. You\u2019ll be able to enable it quickly, while your site is being cleaned, minimizing damage in the eyes of both visitors and search engines.<\/p>\n\n\n\n The best way to enable maintenance mode is by using .htaccess to redirect all requests to an html page<\/a>. This way, any malicious files left on your domain will become inaccessible and will forward to the said page.<\/p>\n\n\n\n To clean your website, you can either restore from a clean backup or remove the malicious code from files and databases. Whatever the method of cleaning, you will have to make sure the vulnerability is eliminated afterward.<\/p>\n\n\n\n Restoring a Clean Backup<\/strong> Remove the Malicious Code From Files and Database<\/strong> Eliminate the Vulnerability<\/strong> SiteGround customers can order a thorough malware cleanup, by going to Client Area -> Contact us -> Expert Care Service -> Malware Cleanup<\/a>.<\/p>\n\n\n\n At the end of the process, you should change all passwords of all users, tools, and devices that have access to your site (control panel, FTP, SSH, etc.). Make sure the same is done by all website collaborators. Do this before you go live.<\/p>\n\n\n\n Another thing you should consider at this point is your website users and visitors. Analyze the situation and find out if any of their data was exploited during the attack. If yes, it\u2019s a good idea to communicate it, along with a password change and any other needed actions to users.<\/p>\n\n\n\n
There are tools that monitor the front-end of your site for uptime and content changes, such as Pingdom<\/a>. There are also tools that monitor the source code of your website for hacks, such as our own HackAlert service<\/a>. Both can be set up to send various notifications and the options here are endless.<\/p>\n\n\n\n
Although you cannot count on it for an early warning, Google\u2019s Search Console<\/a> detects a plethora of hacks. Set up your site and make sure to enable email alerts in the preferences. It\u2019s a good idea to keep an eye on Google\u2019s security status regarding your site. Best of all, it\u2019s free.<\/p>\n\n\n\n<\/span>2. Make a Backup<\/span><\/h2>\n\n\n\n
<\/span>3. Get the Access Logs<\/span><\/h2>\n\n\n\n
<\/span>4. Have Maintenance Mode Ready<\/span><\/h2>\n\n\n\n
<\/span>5. Clean the Website and Vulnerability<\/span><\/h2>\n\n\n\n
This is the fastest, easiest and cheapest option that most people will be able to perform on their own with their backup tool. However, it comes with some disadvantages. If you are running a website that is updated frequently, you may lose some data (e.g. an online store might lose some orders). Also, you can never be sure that the backup you are restoring is completely clean.<\/p>\n\n\n\n
This is the more effective option, but it can prove extremely difficult depending on the hack. If you are not completely sure what you are doing, it\u2019s best to use a 3rd party cleaning service. Identifying and removing attacks is well beyond this blog post.<\/p>\n\n\n\n
This is where the access logs come into play, however, once again this can become a difficult task that you should be confident with when performing it on your own. At the end of the day, you need to know the malicious code was removed from your files and database, together with the vulnerability used to access and modify those files and databases.<\/p>\n\n\n\n<\/span>6. Return to Live<\/span><\/h2>\n\n\n\n
<\/span>How to secure your WordPress website? (video tutorial)<\/span><\/h2>\n\n\n\n