How to clean up a compromised site

Cleaning up is only half the job — if the door that let the infection in stays open, it comes back. Work through this in order.

1. Check what was found

1 In cPanel, open Imunify Security and review what's listed under detected or quarantined items — this tells you which files are affected before you change anything.

2. Change every password, immediately

1 Most infections start with a stolen or guessed password, not a mysterious exploit. Change your cPanel password, your CMS admin password (WordPress, Joomla...), and its database password.
2 If several people have access (see managing sub-accounts, if applicable), have everyone change theirs too — not just the account owner.

3. Update everything

1 Update your CMS core, every plugin and every theme to their latest versions. An outdated plugin is the single most common way sites get compromised.
2 Remove any plugin or theme you no longer use entirely, rather than leaving it deactivated — unused code is still a target.

4. Restore from a clean backup, if you have one

1 If you have a backup from before the infection, restoring it can be faster than manual cleanup — just make sure you also complete steps 2 and 3 afterwards, or the same hole lets the infection straight back in.
Don't just delete the warning banner or the flagged file. If a plugin was exploited to place it there, removing only that one file leaves the vulnerability open and the infection typically returns within days.

Still showing warnings after this, or not sure where to start? Open a support ticket and describe what Imunify Security flagged — we can advise on next steps.

Want a second pair of eyes on this before you touch anything? Ask us first.

Open a support ticket

SEE ALSO

Not sure yet that it was hacked? How to tell if your site has been compromised.

WEB HOSTING

Looking for hosting that stays out of your way?

cPanel, a free SSL certificate, backups every night before dawn kept for a year, and support that answers in your language.

See hosting plans

Free migration of your current site · no lock-in

  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and...
Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you — skip to the note below. This is...
How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http://...
How to tell if your site has been compromised Most infections don't announce themselves — they show up as small, odd symptoms before anything looks obviously...
How to activate and install a paid SSL certificate Every domain here already gets a free certificate automatically — see what an SSL certificate is. This page is only...