11

What would you do as first thing if your website was hacked? Taking the site from net? or rollback a backup? not realy or? Did you made any experiences in this way?

streetparade
  • 101

8 Answers8

11

The first thing I would do is to take it off the net at least till I understand what exactly is the damage. Assessing what has been compromised in a timely manner is most crucial.

Sands
  • 101
3

Take the site offline.

This is crucial. If the intruder is still in your system and you start poking around, they might notice that you have detected their presence and try to cover their tracks (i.e. delete things).

user26868
  • 281
2

Take it off-line and restore the entire machine, not just the web pages, from your backups. Then, before putting it back on-line, fix the hole they used to get in.

John Gardeniers
  • 27,844
1

Hopefully your oganization has a written document that specifies the steps to be taken, who is involved, who is to be contacted. If not begin writing one up immediately. Have you reported it to police cyber-crimes unit, etc.? Don't wait until next time.

jl.
  • 1,076
0

Change your passwords, and then restore from a backup. Then check your logs, contact your host, etc.

Sampson
  • 530
0

That depends on several factors. This includes things such as the sensitivity of your site's data and cost of losing or corrupting data hosted on your site.

I believe the first thing to do is to assess the level of threat in terms of the level of damage and cost to repair. The next thing to do is act accordingly.

0
  • Understand that your web host understands how important your site is.
  • Wipe the OS and re-install from backups. Don't ask your host to have a "quick look" to see if they can clean it up (this will prolong the downtime.)
  • Learn from the experience (as it's almost guaranteed you do not have everything 100% backed up and a disaster recovery plan written)
Andrew
  • 626
-1
  • take it offline
  • make backup
  • check / analyze (when you have time)
  • restore the last known to be good backup

You can later analyze the compromised files.

cstamas
  • 6,917