This question already has an answer here:
- How do I deal with a compromised server? 13 answers
one of my site hacked few times :( first I lost all databases, some tables were cleared and some of table's data had changed! than at the second hack, all tables were cleared and some php files' codes had been changed :/
it is hosted in Bluehost, and now they advise me some fixing;
- Fix any loose file permissions (this may be the most common exploit vulnerability)
- Delete all non-system Ftp Accounts that were created, or at the very least, change the passwords to the FTP Accounts.
- Remove any Access Hosts by clicking the “Remote Mysql” icon and clicking the Remove Red X by each entry if there are any entries.
- Check your scripts for any Header Injection attacks, Sql Injection attacks, Cross-Site Scripting attacks, etc., as well as your php.ini file settings.
- If your scripts are infected, you may want to rollback to the last good snapshot backup of your account. If your backups are also infected, then you may want to consider having us reset your account to start afresh.
I tried to do all these as much as I could, especially about "Header Injection attacks, Sql Injection attacks, Cross-Site Scripting attacks, etc., as well as your php.ini file settings". I'm kind of beginner at this work, so I dont have fully control on thiese things...
my question is; is there any way to find out how I was hacked? What was the weak point?