Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

My site was hacked. Most html and javascript files in my site were modified to included the link in the question title. What strategies should I employ to reduce the likelihood of my site being hacked again?

share|improve this question

marked as duplicate by MDMarra, Iain, Dave M, squillman, MadHatter Nov 21 '13 at 17:37

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

up vote 2 down vote accepted

1) Restore from a known good backup

2) Change all passwords, this includes passwords for any service accounts you might have.

3) Double check your firewall config and disable any services you aren't actually using

This is to get you back up and running now. To prevent it from happening again you need to find out how it happened. Was it a brute force? Was it some exploit on an unpatched package? Etc Etc. You need to look through your logs and discover their attack vector.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.