Member Avatar for cmwhite87

Ok my website, URL SNIPPED was hacked in the last 2-3 weeks. I've tried clearing the public files on my FTP account and reloading all my files, but that did nothing. I'm not very good with the cpanel yet, but I have no idea where to begin in getting this cleared up... Any pointers?

  • 2 Contributors
  • 3 Replies
  • 98 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by cmwhite87

Dani AI

Generated

A short, practical cleanup + hardening checklist for cPanel-hosted sites that builds on the file-permissions point raised by and the fact of a recent compromise in this thread (for ).

  • Preserve evidence first: ask the host for a full account snapshot (files + DB) and download it before making changes.
  • Change all access credentials: cPanel/WHM, FTP/SFTP, database user passwords, CMS admin accounts, and any API keys. Use strong, unique passwords.
  • Search for backdoors and recent changes: look for recently modified files, unknown cron jobs, and strange .htaccess rules. If you have SSH access, use targeted scans and pattern searches (examples below).
  • File-permission baseline: set directories to 755 and files to 644; make sensitive config files 600/640. Remove world-writable bits. This reduces easy write access for attackers.
  • Clean or restore from a known-good backup: only restore after verifying the backup is clean. Reinstall core CMS files and extensions from official sources.
  • Check the database and user lists for injected content or rogue admin users.
  • Harden: disable plain FTP (use SFTP/SSH), apply updates, enable mod_security/WAF if available, and restrict PHP execution in upload directories.

Example SSH checks (run only if you have shell access; these are detection steps, not fixes):

find public_html -type f -perm /o+w -ls

grep -RIn --exclude-dir=vendor -E "base64_decode|eval\(|shell_exec\(|exec\(|passthru\(|preg_replace\(.*e" public_html

Authoritative guidance: Google’s recovery steps for hacked sites and an overview of Linux file permissions are useful next reads: , . If unsure, get the host to scan logs (access, error, mail) or engage a professional cleanup service.

Recommended Answers

All 3 Replies

Member Avatar for cmwhite87

ok so I got rid of the index.html file that mine was replaced with. so the site at least doesn't show it was hacked now lol. I guess I'll be talkin to my webhost next to be sure its secure.

Member Avatar for peter_budo

It may not necessary webhost fault if you mess up with file privileges....

Member Avatar for cmwhite87

I haven't ever thought of file privileges. I'll have to see what kind of options I have on the cpanel.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.