Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

My site was hacked. Most html and javascript files in my site were modified to included the link in the question title. What strategies should I employ to reduce the likelihood of my site being hacked again?


locked by HopelessN00b Jan 22 '15 at 0:08

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

marked as duplicate by MDMarra, Iain, Dave M, squillman, MadHatter Nov 21 '13 at 17:37

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 2 down vote accepted

1) Restore from a known good backup

2) Change all passwords, this includes passwords for any service accounts you might have.

3) Double check your firewall config and disable any services you aren't actually using

This is to get you back up and running now. To prevent it from happening again you need to find out how it happened. Was it a brute force? Was it some exploit on an unpatched package? Etc Etc. You need to look through your logs and discover their attack vector.


Not the answer you're looking for? Browse other questions tagged or ask your own question.