Skip to content
HostPora
Securityadvanced3 min read

Recover a Compromised Website

Contain access, preserve useful evidence, rebuild from trusted material and close the entry route before restoring public traffic.

Written by HostPora Academy Team · Technical review by HostPora Technical Review · Updated Nov 2, 2026

Step 1

Contain without destroying evidence

Restrict public access where possible, record alerts and preserve relevant logs before deleting files or reinstalling software.

  1. 1Take service offline safely
  2. 2Preserve logs and timestamps
  3. 3Notify the service owner
Step 2

Find scope and entry route

Review administrator accounts, vulnerable software, modified files, scheduled tasks and stolen credentials. Assume a visible file is not the full incident.

  1. 1Audit users
  2. 2Compare clean source
  3. 3Review cron and startup paths
Step 3

Recover from trusted sources

Rebuild or restore clean code, patch the entry route, rotate affected secrets and monitor closely after return.

  1. 1Restore trusted data
  2. 2Rotate credentials
  3. 3Verify backups and monitoring

Did this guide solve the task?

Your response helps prioritize corrections and missing steps.

Thanks. Your feedback will guide the next article review.

Related guidance

Continue from this task.

WordPress

Secure WordPress After a Migration

Read next →VPS

Prepare a VPS for Production

Read next →

Common questions

Resolve the details before changing production.

Should I delete the malicious file and reopen the site?+

No. The attacker might have added other access routes or stolen credentials. Determine scope and entry route first.

Which passwords need rotation?+

Rotate credentials available to the compromised application or shared during response, including panel, database, application and deployment secrets.

Can an old backup be trusted?+

Only after checking its date, integrity and whether compromise existed before the backup.

Ready when you are

Find the hosting that fits your next move.

Compare resources, full-term totals and renewals before you choose. WHMCS handles checkout and billing.

Find my plan

Built for the tools websites and applications use

cPanel DirectAdmin LiteSpeed Softaculous WordPress Node.js Laravel Python PHP MySQL MariaDB NGINX Linux Drupal Joomla NVMe Cloudflare Let's Encrypt

Availability varies by plan and operating environment. Product names belong to their respective owners.