What would you do as first thing if your website was hacked? Taking the site from net? or rollback a backup? not realy or? Did you made any experiences in this way?


8 Answers 8


The first thing I would do is to take it off the net at least till I understand what exactly is the damage. Assessing what has been compromised in a timely manner is most crucial.


Take the site offline.

This is crucial. If the intruder is still in your system and you start poking around, they might notice that you have detected their presence and try to cover their tracks (i.e. delete things).


Take it off-line and restore the entire machine, not just the web pages, from your backups. Then, before putting it back on-line, fix the hole they used to get in.

  • I know this sounds like common sense, but make sure you find out how they got in before you restore the entire machine, as you will lose the logs, etc when you restore from the backup. Jan 22, 2010 at 23:34

Hopefully your oganization has a written document that specifies the steps to be taken, who is involved, who is to be contacted. If not begin writing one up immediately. Have you reported it to police cyber-crimes unit, etc.? Don't wait until next time.


Change your passwords, and then restore from a backup. Then check your logs, contact your host, etc.


That depends on several factors. This includes things such as the sensitivity of your site's data and cost of losing or corrupting data hosted on your site.

I believe the first thing to do is to assess the level of threat in terms of the level of damage and cost to repair. The next thing to do is act accordingly.

  • Understand that your web host understands how important your site is.
  • Wipe the OS and re-install from backups. Don't ask your host to have a "quick look" to see if they can clean it up (this will prolong the downtime.)
  • Learn from the experience (as it's almost guaranteed you do not have everything 100% backed up and a disaster recovery plan written)
  • take it offline
  • make backup
  • check / analyze (when you have time)
  • restore the last known to be good backup

You can later analyze the compromised files.

  • Only check/analyze if you have the time? Why would you put the system back online, without fixing the vulnerability that the attacker exploited the first time? Jan 22, 2010 at 23:37
  • You are right. "when" is what I meant instead of "if". Sometimes it is critical to have the service back online and in the meanwhile you can analyze the backup of the compromised machine.
    – cstamas
    Feb 2, 2010 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.