Webhosting – Compromised Website

In this guide you will learn:

• How a compromised website shows itself
• How to deal with a compromised website
• How to protect your website against compromise
• Frequently Asked Questions

---

Symptoms of a Compromised Website

A compromised website most often shows one or more of these symptoms:

• Spamming. Malicious software uses insecure contact forms, or the PHP mail() function in general, to send out spam. On our side, spamming is limited by a daily limit on the number of sent emails, and we consistently monitor when the limit is approached or reached. When we record increased volumes of sent emails that violate the rules and restrictions on sending emails ⧉, we may disable the mail() function completely on our side.
• Redirection. The user is redirected to another website immediately after arriving at the page. We cannot reliably detect this kind of compromise on our side, because any redirect may also be intentional.
• Phishing pages or other unwanted content. In addition to or instead of legitimate content, the website contains fraudulent pages, intentionally harmful content, or, conversely, a completely blank page. Phishing is most often reported by users or the police. Deleted content may be the result of an attack as well as a failure of the content management system (for example the WordPress White Screen of Death ⧉).
• Scripts attacking other targets. This type of compromise often has no easily noticeable symptoms. It is only revealed by the response to suspicious traffic from the server’s IP address, in the form of abuse reports or outright blacklisting.
• PHP backdoor (crypt PHP). This file allows attackers to access the website even without proper authorization and to repeatedly upload problematic pages and scripts that you delete.

---

Resolving a Compromised Website

VEDOS deals with a compromised website to the extent necessary to prevent damage in these cases:

• Spamming that endangers the reputation of emails sent by our servers. In this case we disable the PHP mail() function, or block the SMTP server of the Webhosting email services. We send information about the restriction to the service’s billing email.
• Phishing, where there is a risk of leakage or misuse of sensitive data of website visitors. Immediately after reviewing the situation, we block access to the website and send information about the restriction to the service’s billing email.
• Attacks on other targets within our infrastructure and beyond. Depending on severity, we usually first communicate with the hosting owner through the billing email; in extreme cases we shut the website down until the malicious software is removed.

In other cases, where there is no urgent danger, solving the problem is entirely in the hands of the hosting service owner or webmaster. We recommend following these steps:

1. Back up your website. Even a compromised website may contain files and data you do not want to lose. You can find more information about backups in the article Webhosting – Backup.
2. Run an antivirus scan and clean up the files on FTP. The goal of the scan is to find and remove malicious scripts. Various approaches are available, depending on the content management system used:
   • Complete scan. Download the complete website content from FTP and scan it with an antivirus program. Replace damaged files with healthy ones from an older backup. When the scan is complete, upload the website back to the cleaned FTP.
   • Reinstallation. Download and check only the user components of the content management system (for example the wp-content/uploads directory of WordPress). Delete the rest of the FTP contents and replace it with a clean installation of the content management system. Then connect it to the original database and upload the checked data.
3. Secure your website against further compromise. Scan with an antivirus program all devices that have access to website management as well. Change the access passwords to the website administration and to FTP. Make sure the website uses the current version of the content management system and plugins.

---

Preventing Website Compromise

To best prevent your website from being compromised, follow these rules:

• Regularly update the content management system, all themes and plugins. If no update has been released for a component for a long time, check whether it is outdated and, if necessary, replace it with another, continuously updated solution.
• Block unused FTP accounts. You can find the guide in the article Webhosting – FTP Accounts.
• Update the PHP version. If your system allows it, keep the PHP version at the highest possible value. If you run into a compatibility problem, find out which part of the content management system is incompatible and consider whether it is outdated and poses a security risk.
• Follow the security recommendations of the content management system. For many content management systems, you can find security recommendations directly from their developers. For example, for WordPress you can find them at https://codex.wordpress.org/Hardening_WordPress ⧉.

---

Frequently Asked Questions

Was this article helpful?

Your feedback helps us improve our articles.

YesNo

Would you like to tell us something about this article? (optional)

Your message goes to the documentation team, who do not reply to it. If you need help, contact us using the contact form. Do not include passwords or personal data.

Leave this field empty