Incident Response: What to Do After a Website Is Compromised

When a website is suspected of compromise, the first goal is to limit harm while preserving enough evidence to understand what happened. Avoid immediately deleting suspicious files before recording relevant details.

Record the time discovered, observed symptoms, affected domains, recent deployments, and alerts. If active abuse is occurring, isolate the affected service or restrict access in a controlled way. Preserve logs and snapshots where possible, and coordinate with the hosting provider if the server itself may be compromised.

Rotate credentials from a clean device, including hosting, SSH, database, CMS, deployment, email, and API credentials that may have been exposed. Do not assume changing the CMS password alone is sufficient. Identify persistence mechanisms such as rogue administrator accounts, scheduled tasks, injected code, or altered deployment keys.

Restore only from a known-good backup after determining the likely entry point and patching it. Update vulnerable software, review permissions, and monitor for recurrence. Document customer impact and required notifications. A successful restore without root-cause remediation can simply restart the incident.