My Website Was Hacked: What to Do Step by Step (Malware Cleanup and Imunify360)

If your website was hacked, work in this order: lock the attacker out by changing every password, take the site offline and save a copy as evidence, find the infection with the Imunify360 malware scanner and a check of recently changed files, then clean up. The cleanest fix is restoring a backup from before the breach. You then reinstall WordPress core and plugins from official sources, delete backdoors and malicious cron jobs, and close the hole the attacker used. This guide applies to Cloudesta shared cPanel hosting and to any cPanel or Linux server running WordPress or another PHP site.

Prerequisites

• Access to your cPanel account. On a VPS, you need root SSH access instead.
• cPanel Terminal (Advanced > Terminal) or SSH access for the command-line checks. If neither is available, use File Manager and open a ticket.
• WP-CLI (the wp command) for the WordPress steps, if your server has it installed.
• Access to Google Search Console for your domain, if Google is showing a warning.

How do I know my website has been hacked?

These are the most common signs of a compromise:

• Visitors are redirected to scam, casino or pharmacy sites. This often happens only on mobile devices or only for visitors arriving from Google.
• Google results show spam pages under your domain, such as Japanese or pharma keywords.
• Google or your browser shows "This site may be hacked" or "Deceptive site ahead".
• Unknown administrator users appear in WordPress, or unfamiliar FTP accounts appear in cPanel.
• Your mail queue fills with spam, bounce messages arrive for emails you never sent, or your account is suspended for outgoing spam.
• You find PHP files you did not create, especially in wp-content/uploads.

1. What should I do immediately after a hack?

Change all passwords

Change the passwords in this list, in this order:

• Your Cloudesta client area password.
• Your cPanel password, under Preferences > Password & Security.
• Every FTP account, under Files > FTP Accounts. Delete any FTP account you do not recognise.
• Every email account, under Email > Email Accounts.
• The database user, under Databases > MySQL Databases. Afterwards, update DB_PASSWORD in wp-config.php to match.
• Every WordPress administrator account.

Also generate new WordPress salts at https://api.wordpress.org/secret-key/1.1/salt/ and replace the matching lines in wp-config.php. This logs out every session, including the attacker's.

Put the site in maintenance mode

Block everyone except your own IP address while you work. Add these lines at the very top of public_html/.htaccess, replacing 203.0.113.10 with your public IP:

<RequireAny>
  Require ip 203.0.113.10
</RequireAny>

Save an evidence copy

Before you change anything, archive the infected site and its database outside public_html. This copy helps you trace how the attacker got in. Never restore from it.

cd ~
tar -czf hacked-evidence-$(date +%F).tar.gz public_html
mysqldump -u dbuser -p dbname > hacked-db-$(date +%F).sql

2. How do I find the malware?

Check Imunify360 scan results

On Cloudesta shared hosting, Imunify360 scans your files automatically. To review its results:

• In cPanel, go to Security > Imunify360 and open the malware scanner section.
• Run a new scan of your account.
• Review the list of detected files. Depending on the server configuration, you may see actions such as cleanup or restore for each file.
• Note the paths and dates of the detected files. The oldest date tells you roughly when the breach happened.

Find recently modified and suspicious files

Scanners miss things, so also check by hand. Run these commands in cPanel Terminal or over SSH.

List PHP files changed in the last 7 days, newest first:

find ~/public_html -type f -name "*.php" -mtime -7 -printf '%TY-%Tm-%Td %TH:%TM %p\n' | sort -r

Find PHP files inside the uploads folder. The uploads folder should hold only media, so treat any result as suspicious:

find ~/public_html/wp-content/uploads -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \)

Search for code patterns that are common in malware:

grep -rlE "eval\(base64_decode|gzinflate\(base64_decode|str_rot13\(|eval\(\\\$_(POST|GET|REQUEST)" ~/public_html --include=*.php

Check cron jobs and .htaccess files

Attackers often add a cron job that downloads the malware again after you remove it. Review Advanced > Cron Jobs in cPanel, or run:

crontab -l

Delete any entry that runs curl, wget, base64 or files you do not recognise.

Next, list every .htaccess file:

find ~/public_html -name ".htaccess" -printf '%TY-%Tm-%Td %p\n'

Open each file and look for injected rules, such as RewriteCond %{HTTP_REFERER} or HTTP_USER_AGENT lines that redirect to foreign domains.

Check for unknown admin users

List all WordPress administrators. If you find one you did not create, delete it and give its content to a legitimate user (ID 1 in this example):

cd ~/public_html
wp user list --role=administrator
wp user delete 5 --reassign=1

3. How do I clean a hacked website?

Option A: Restore a clean backup (recommended)

In cPanel, open Files > JetBackup 5. Restore both the files and the database from a date before the oldest malicious file you found. Even a clean backup still contains the vulnerability the attacker used, so complete section 4 immediately after the restore.

Option B: Clean file by file

If there is no clean backup, replace the code with fresh copies from official sources. These commands reinstall WordPress core without touching wp-content, reinstall a plugin, and then check every file against the official checksums:

cd ~/public_html
wp core download --force --skip-content
wp plugin install plugin-slug --force
wp core verify-checksums
wp plugin verify-checksums --all

Then finish the cleanup:

• Reinstall themes from their official source.
• Delete every PHP file found in uploads.
• Remove any injected code at the top of wp-config.php.
• Delete files that verify-checksums reports as "should not exist".
• Remove injected <script> tags from posts and options in the database.

4. How do I stop my site being hacked again?

Cleaning removes the malware, but it does not remove the weakness the attacker used. Take these steps to close it:

• Update WordPress core, all plugins and all themes with wp core update and wp plugin update --all.
• Delete plugins and themes you are not using, including inactive ones.
• Turn on two-factor authentication for WordPress admins and for cPanel (Security > Two-Factor Authentication).
• Reset file permissions so that directories are 755, files are 644 and wp-config.php is 600.

To reset the permissions, run:

find ~/public_html -type d -exec chmod 755 {} \;
find ~/public_html -type f -exec chmod 644 {} \;
chmod 600 ~/public_html/wp-config.php

Finally, stop PHP from running in the uploads folder. Create wp-content/uploads/.htaccess with this content:

<FilesMatch "\.(?i:php[0-9]?|phtml|phar)$">
  Require all denied
</FilesMatch>

When everything is done, remove the maintenance lines from the main .htaccess file.

5. How do I remove the Google "hacked site" warning?

In Google Search Console, go to Security & Manual Actions > Security issues. Confirm that you have fixed the listed issues, then click Request Review. Briefly describe what you cleaned and how you closed the hole. Reviews usually take from a few days to a couple of weeks.

If you would rather have specialists handle all of this, Cloudesta's Website Malware Scan & Cleanup service scans, cleans and hardens the site for you.

Verify it works

• Run a new Imunify360 scan. It should report no infected files.
• Confirm that wp core verify-checksums and wp plugin verify-checksums --all both report success.
• Load the site from a mobile network and from a Google search result. There should be no redirects.
• Run the file search from section 2 again after 48 hours. Repeat the find ... -mtime -2 check, and confirm no new PHP files have appeared in uploads.
• Check Email > Track Delivery for any unexpected outgoing mail.

Common problems

• The site is reinfected within days. A backdoor or cron job was missed, or a vulnerable plugin is still installed. Re-check cron jobs, other sites in the same account, the uploads folder and recently modified files. Make sure every plugin is updated or removed.
• The account is suspended for outgoing spam. Open a ticket so support can show you what was sending mail. Then reset all email passwords, delete unknown forwarders and remove the mailer script before asking for the account to be unsuspended.
• The site breaks after an Imunify360 cleanup. The infected file was a legitimate plugin or theme file. Reinstall that plugin or theme from its official source.
• The Google warning is still shown. The review is either pending or failed. Check the Security issues report for any remaining URLs, clean them, and request another review.

Frequently asked questions

Does Imunify360 remove malware automatically?

It detects malware automatically and can clean many infections, depending on the server's configuration. It cannot fix the outdated plugin or weak password that let the attacker in, so you still need to complete the hardening steps.

Is restoring a backup enough to fix a hack?

No. A backup removes the malware, but the vulnerability is restored with it. Update everything and change all passwords immediately after the restore.

How far back should my clean backup be?

Choose a backup from before the oldest malicious file date you found, not just from before you noticed the problem. Attackers often install backdoors weeks before they become visible.

Need help? Open a support ticket at https://cloudesta.com/submitticket.php and include your domain and what you have found so far.