Site Hacked

[mmicha]

Hello,

 

I've been alerted that sites under my account have been compromised.  We are not running Wordpress or any actual CMS type of system.

 

Yet, somehow malware html has been injected into several pages of these sites.  Can you explain how that can happen and how to prevent it?

 

Has my whole administrator account been hacked, it just appears pages.

[Fowler]

Hi,

Not an official reply but it sounds very much like your FTP or cpanel details have got into the wrong hands. The first thing you should do if change passwords for your cPanel and FTP accounts you have set up. Then clear up your site. A quick way to see what files have been modified recently is by sorting all your files by the last modified date in cPanel or FTP.

HH staff will be able to give a better answer as they have details on your account.

[tekiegreg]

My typical response for anything hacked " bulldoze your site and restore from a last backup that worked", you can do that from Cpanel if you still have access.  Then change all FTP/Cpanel passwords.

[Brian]

Yet, somehow malware html has been injected into several pages of these sites.  Can you explain how that can happen and how to prevent it? Has my whole administrator account been hacked, it just appears pages.

 

Impossible to say without having a detailed look at your account I'm afraid. If you have a ticket open, let me know the ID and I'll take a look if it hasn't been addressed already.

 

Not an official reply but it sounds very much like your FTP or cpanel details have got into the wrong hands. The first thing you should do if change passwords for your cPanel and FTP accounts you have set up. Then clear up your site. A quick way to see what files have been modified recently is by sorting all your files by the last modified date in cPanel or FTP.

 

Spot on advice. Also worth scanning your computer, and the computers of anyone with access to the site, for viruses. A lot of times a compromised local machine leads to stolen login credentials.

 

My typical response for anything hacked " bulldoze your site and restore from a last backup that worked", you can do that from Cpanel if you still have access.  Then change all FTP/Cpanel passwords.

 

And this hits on the importance of backups. We do keep backups of user files and databases, but at any given time those may be inaccessible and/or unavailable (though this rarely happens). Keep regular and consistent backups!