What should I do if my website is maliciously tampered with? Teach you practical ways to recover quickly

for companies or individual webmasters who rely on website operations, the website is maliciously tampered with is a highly destructive emergency. It may be that the homepage is replaced with illegal content, it may be that the page is implanted with malicious advertisements, or it may be that the core function is locked, which will not only make existing users churn, but also cause search engine downgrades, brand reputation damage and other chain problems. Many webmasters will be at a loss when encountering such a situation. In fact, as long as they master scientific processing steps, they can quickly stop losses and restore the normal operation of the website. This article will find long-term protection from emergency treatment, data recovery, and vulnerability scheduling, and sort out the complete solution after the website is maliciously tampered for you.

How to stop losses after the website is maliciously tampered with?

find that the website has been maliciously tampered with, the first thing to do is not to rush to restore the data, but to cut off the spread of malicious influence to avoid greater losses.

1 Temporary suspension of website access

can close the website port through the server control panel, or pause the resolution in the background of domain name resolution to prevent users from accessing the tampered page, avoid illegal content being crawled by users or search engines, and prevent further damage to brand perception. If you use Cloud as a Service, you can also temporarily block external access through security group rules, which is faster to operate.

2, backup the current tampered data

don't rush to delete the tampered files, but first fully backup all the files and databases of the current website. This step is essential for subsequent investigation of the cause of tampering and tracing the attack path. You can package and download the root directory and database files of the website to the local through the backup tool of the server, or you can use the snapshot function of Cloud as a Service to complete the backup to ensure the integrity of the data retention.

How to return to normal after the website is maliciously tampered with?

complete the emergency stop loss, you can enter the core website recovery link, this step to ensure that the restored website data is complete and functional.

1, restore data from reliable backup

give priority to the latest reliable backup of the website before it is maliciously tampered with, preferably a full backup within the past 72 hours, including website program files and databases. If it is a website built with a CMS system, it can be operated through the background backup recovery function, or you can directly upload the backup file to cover the tampered file on the server, and then import the backup database. After completion, test whether the page display and core functions are normal.

2, no backup manually clean the tampered content

if there is no available backup, you need to manually check the tampered files. First check the code of the core pages such as the homepage and column pages, delete the implanted malicious scripts and illegal content, and then check the suspicious files in the root directory of the website one by one, such as unfamiliar PHP, JS files, and modified configuration files. After cleaning, test the pages one by one to ensure that there is no residual malicious code, and pay attention to keep the backup of the original files to avoid deleting the core content by mistake.

What vulnerabilities should be investigated after the website is maliciously tampered with?

restore the normal operation of the website, it is necessary to find the root cause of the malicious tampering of the website, otherwise it is likely to encounter the same attack again.

1, troubleshooting server permission vulnerabilities

check the permissions settings of website files and directories. Many websites are maliciously tampered with because the permissions are too high. For example, the root directory of the website is set with 777 permissions, which allows attackers to modify files at will. Adjust permissions according to the principle of least privilege, such as setting the website file to 644 and the directory to 755. At the same time, check the server's administrator account, delete excess suspicious accounts, and modify the administrator password to a complex combination password.

2, troubleshooting program plug-in vulnerabilities

if you are using an open source CMS system, to check the version of the core program, theme and plug-ins, timely update to the latest security version, many attackers will use known unpatched plug-in vulnerabilities to invade the website. At the same time, to delete unused redundant plug-ins and themes, reduce potential attack entry, but also check the background login log to see if there is a strange IP login record, if so, timely ban the IP.

How to do long-term protection after the website is maliciously tampered with?

solve the problem of the current website being maliciously tampered with, it is necessary to establish a long-term security protection mechanism to reduce the risk of being attacked again from the root.

1, regular automatic backup of website data

set up the automatic backup mechanism of the website, it is recommended to make incremental backups every day, make full backups every week, and store the backup files to a remote server or local hard drive to avoid losing the backup files at the same time when the server fails or is attacked. Many Cloud as a Service providers provide automatic backup functions. Webmasters can set the backup cycle and storage location according to their needs to ensure the security and recoverability of backup data.

2 Deploy website security protection tools

can install a website firewall (WAF) to intercept SQL injection, XSS cross-site scripting and other common attack methods, monitor website access requests in real time, and automatically ban suspicious IPs. At the same time, an intrusion detection system (IDS) can be deployed to detect abnormal operations and file modification behaviors of the server in time. Once suspicious actions are detected, an alarm will be issued immediately, so that the webmaster can intervene in the first time to avoid the situation of the website being maliciously tampered with again.

To sum up, although the website is maliciously tampered with suddenly, as long as it is dealt with according to the steps of emergency stop loss, data recovery, vulnerability investigation and long-term protection, the problem can be quickly solved and the subsequent risk can be reduced. The core is to keep calm, first control the loss range, and then restore the data through reliable backup, then check the vulnerabilities from the server and program level, and finally establish a normal security protection mechanism, so that the website can always be in a safe and stable running state, providing reliable support for business development.