What to do if your website is hacked

Before you start

• Access to your FoxFolio Cloud account and the control panel
• A recent clean backup, if you have one

Applies to: Cloud Hosting, WordPress Cloud, Managed WordPress.

What FoxFolio Cloud does and does not do

• We keep the platform secure, scan hosted files daily, and explain what the scanner and logs show.
• Managed WordPress includes alert interpretation and initial triage for the managed site.
• Removing malware, repairing custom code and rebuilding a compromised site are not included in any plan. We can quote that work before it starts.
• If a site is actively harming others, for example sending spam or hosting phishing pages, we may suspend it immediately under the Terms of service and tell you afterwards.

Steps

1. Change passwords

   Change your FoxFolio Cloud account password, WordPress administrator passwords, SFTP and database passwords, and any mailbox passwords used on the site. Remove users you do not recognize.

2. Find what changed

   Run the malware scanner and note flagged files. Check the access and error logs for unfamiliar activity around the time the problem started.

3. Download a copy first

   Create an on-demand backup of the current state so nothing is lost if you need to investigate later. See Create an on-demand backup.

4. Restore or replace

   Restore a backup made before the compromise, or replace infected files with clean copies from the original source. See Restore files or a database.

5. Close the gap

   Update WordPress, themes and plugins; delete ones you do not use; and follow Keep your website access secure.

6. Scan again

   Choose Scan again in the malware scanner and keep watching the next few daily scans.

Troubleshooting and common mistakes

The infection returns after cleanup.

Something vulnerable is still installed, or a password was not changed. Remove unused plugins and themes and change every password again.

You have no clean backup.

Reinstall WordPress core, themes and plugins from official sources and keep only your own content. Consider paid cleanup if the site has custom code.

Related guides

• Use the included malware scannerFoxFolio Cloud hosting includes a malware scanner that checks your website’s changed files every day. Open Malware Scan in the control panel to see results and choose Scan again after a fix. While infected files remain, sending mail from the website and scheduled tasks can be paused automatically; they come back after a clean rescan. The scanner finds problems; cleaning them is not included.
• Keep your website, FTP and WordPress access secureUse a unique, strong password for every tool, prefer SFTP or SSH keys to plain FTP, give each person their own WordPress login with only the role they need, and remove access as soon as someone no longer needs it. Keep WordPress and its plugins updated. Passwords stored in the control panel cannot be viewed later, so keep them in a password manager.
• Restore files or a database from a backupBefore restoring anything, create and download a fresh backup of the site as it is now. Then open Backup/Restore, choose a restore mode (replace existing files, add missing files only, or restore to a temporary folder), tick Restore Databases only if you want the database replaced, and upload a ZIP made by this tool. Check the site carefully afterwards.
• What Managed WordPress includes and excludesManaged WordPress covers one WordPress site: one reviewed installation or migration, automatic minor and security core updates, scheduled review of major core, active plugin and active theme updates, availability and security alert triage, a backup before FoxFolio-managed changes, restore coordination and authenticated support. Content, design, SEO, custom code, third-party licences and malware cleanup beyond initial triage are quoted separately.