If your website has been hacked, act immediately. Take the website offline and change all passwords, especially administrator passwords. Then put a clean copy of the website online from a backup while you repair it. If you suspect the hacker saw any customer details, Jamaica’s Data Protection Act gives you 72 hours to inform the Information Commissioner.
How you can tell
Look for these signs.
- Google shows “This site may be hacked” under your listing.
- Your site sends visitors to another website.
- Google lists pages you never made, often for casinos or fake goods.
- A new administrator appears in WordPress, or your password stops working.
- Your host suspends the account for sending spam.
The first hour
Stop the damage first. Figure out how it happened later.
- Put up a holding page, or ask your web host to take the site offline.
- Change the passwords for WordPress, your hosting account, your FTP (File Transfer Protocol) logins and every email account on your domain.
- Turn on two-step login wherever you can.
- Check who has administrator access, and remove anyone you don’t recognise.
- Don’t delete anything yet. The files can show how the hackers got in.
Who to tell
If there were customer details on the website, Jamaica’s Data Protection Act sets a deadline. Under that Act, you must report a breach of personal data to the Information Commissioner within 72 hours of becoming aware of it. You also have to inform the customers who have been affected without delay. Speak to an attorney if you are not sure what you need to report.
- Report the attack to JaCIRT (Jamaica Cyber Incident Response Team) on the form at cirt.gov.jm.
- If money or customer accounts were touched, report it to the police as well.
- If your site takes card payments, tell your bank or payment provider.
Case study of a remediated hack
A hacked site can look perfectly normal and still carry an infection. One client’s site was showing casino and spam pages in its Google search results. We ran a script that checked all the WordPress files against the original WordPress repository of core files. This revealed a plugin with a vulnerability through which attackers were able to upload files to the website. We patched and removed that plugin. Where necessary, we also removed other plugins that were not being used.
We also stopped file uploads from anyone, or any source, that should not be able to upload files. We removed backdoors that were hidden in the WordPress database. Then we set up AI-driven monitoring of file changes, with alerts to our technicians, so we can fix any new hack or further file change right away.
Other methods we have used
Attackers can hide in places a quick scan can overlook.
- On one site, the database was fine, but the attackers had added extra files and folders named similarly to common WordPress pages. Because these files were opened before any WordPress files were, their spam kept being injected into working pages.
- The attackers had also added their own access to the site’s Google Search Console, so they could effectively push their hacked pages to Google.
- In another case, spammers used the contact form’s automatic reply to send spam from the site’s own domain name. We changed the form so that its replies could no longer repeat what a visitor had typed, keeping the site secure.
Keeping it safe
Hackers usually get in through outdated software for which security patches are available but have not been applied. Hackers can also get in through a password that they guessed or that has been compromised.
- Keep WordPress, your theme and every plugin updated.
- Delete plugins you no longer use. A plugin that is switched off can still be a way in.
- Keep backups somewhere other than your hosting account.
- Use a different strong password for each login, with two-step login switched on.
Getting help for your hacked website
We clean hacked WordPress websites and keep them up to date after the fix to prevent further breaches. Before we declare a site clean, we check all its files against the original WordPress repository and check the database for backdoors. Our Wicket-Keeper plans start at US$49.99 per month. They include hosting, a security scan, an SSL certificate and automated backups at several points during the week. We also include unlimited email accounts.
Call us on 876-676-6104 or WhatsApp 876-331-9320. We are open from 8am to 5pm every day.
