hostdoc — offline cPanel/WHM/WHMCS support brain

← all runbooks

---
title: Site is hacked or defaced
panel: WHM / cPanel
symptoms:
  - site shows unexpected content
  - pages redirect elsewhere
  - unknown files in public_html
  - customer reports spam being sent from their account
  - the website has been hacked
  - site is sending spam emails
  - pages are defaced
  - google says the site may be hacked
  - there are strange files in public_html
  - the site redirects to another website
---

# Site is hacked or defaced

## 1. Establish the scope

**Why:** one site is usually an application weakness that you can point
at. Several sites at once, or mail being sent from the account, means
the credentials are compromised and the account is being used against
other accounts as well. The scope decides whether you are fixing one site
or protecting a whole server.

**In WHM:** Account Information > List Accounts. Look for other accounts
with recent changes.

**In the terminal:** `grep -i "suspicious\|malware" /var/log/exim_mainlog`
and check the account's recent files.

**Care:** this only reads.

## 2. Suspend the account before you investigate

**Why:** suspending stops the mail going out and stops any malware
running, and it keeps the damage from spreading to the rest of the
server. A suspended account keeps its files and its mail, so nothing is
lost. Investigating while it is still live means the attacker can undo
whatever you find.

**In WHM:** Account Functions > Manage Account Suspension.

**In the terminal:** `/usr/local/cpanel/scripts/suspendacct <user>`

**Care:** the customer's site goes offline the moment you do this. Tell
them it is happening and why, and give them a time to expect it back.

- https://docs.cpanel.net/whm/scripts/the-suspendacct-script/
- https://docs.cpanel.net/knowledge-base/accounts/what-happens-when-you-suspend-an-account/

## 3. Change the password before you restore anything

**Why:** if the compromised password still works, restoring the site
restores the attacker with it. The password is usually how they got in,
so it is the first thing to change, not the last.

**In cPanel:** the customer changes it in cPanel. For the FTP and mail
accounts, use Change Password in the account's email, or reset them from
the server.

**In the terminal:** `passwd <user>` as root, or
`/usr/local/cpanel/bin/reset_password` style tooling through WHM.

**Care:** changing the cPanel password can break sites that authenticate
to the database with it. Check what else uses that password first.

## 4. Restore from a known good backup rather than cleaning

**Why:** deleting the files that look malicious does not remove the entry
point, and it usually leaves the backdoor behind, because the attacker
has had time to put a second one in a place that does not look wrong.
Restoring a known good copy replaces everything, including the parts you
would not have spotted.

**In cPanel:** Files > File Manager, and the account's backup if the host
keeps one.

**In WHM:** the account's backups, and the Backup Manager.

**In the terminal:** `ls /home/<user>/backup*` for the account's own
backups.

**Care:** restoring overwrites everything the customer has uploaded since
the backup was taken. Say so, and get their agreement before you do it.

- https://docs.cpanel.net/knowledge-base/q-and-a-with-cpanel-support/why-cant-i-clean-a-hacked-machine/
- https://docs.cpanel.net/knowledge-base/backup/system-backups/

## 5. Find how it got in, so it does not happen again

**Why:** restoring without finding the entry point means it happens
again, usually within days. The cause is nearly always an old plugin, a
leaked FTP password, or a weak password on the mail account being used to
send spam. All three are fixable.

**In the terminal:** `ls -la --time-style=long-iso ~/public_html` sorted
by date shows what changed. `grep -i "POST" /home/<user>/logs/<domain>.access_log`
shows what was called.

**Care:** this only reads.

- https://docs.cpanel.net/knowledge-base/cpanel-product/the-cpanel-log-files/
- https://docs.cpanel.net/knowledge-base/email/how-to-prevent-email-abuse/