My site was hacked. What do I do?
Take it offline, restore a clean backup from before the hack, update Joomla and every extension, and change all passwords. Then check for admin accounts you don't know.
Why act methodically
Attackers often leave backdoors: extra admin accounts, hidden PHP files, changed core files. Cleaning only what you can see lets them back in. Restoring a clean backup and closing the hole is safer.
Step by step
- Contain: take the site offline (Site Offline, or a holding page from your host) and change your hosting, FTP and database passwords.
- Keep evidence: make a backup of the hacked state and download the server access logs; they show how the attacker got in.
- Restore: restore a backup from before the hack into an empty folder and database.
- Close the hole: update Joomla and every extension, and remove extensions on the Vulnerable Extensions List or that you don't use.
- Lock down: change all administrator passwords, delete Super Users you don't know, and turn on multi-factor authentication.
- Check and reopen: scan the files, check Google Search Console for security warnings, then bring the site back online.
No clean backup?
Compare the core files with a fresh copy of the same Joomla version, look for PHP files in /images and /tmp, and check users and recently changed files. Or ask a professional; the Joomla forum also has a security board.
Sources
- Security Checklist: You have been hacked or defaced – Joomla Documentation
- Security Best Practices – Joomla User Guide
- Vulnerable Extensions – Joomla User Guide
