If your site is hacked: what to do in the first hour

Late on a Friday, a resident emails a town clerk: the town's homepage is showing a banner about cryptocurrency. Someone logs in to the CMS, deletes the banner, and goes home. On Monday it is back, along with hundreds of hidden spam pages, because the attacker's way in, a backdoor file on the server, was never found. The first hour after you notice a compromise decides how long the incident lasts. This article covers what to do, and what not to do, in that hour.

Signs your site may be compromised

• Content you did not add: banners, links, or pages, sometimes visible only to search engines or mobile visitors
• Redirects to unfamiliar sites, especially from search results
• A browser or search engine warning that the site is unsafe
• New administrator accounts nobody created, or password reset emails nobody requested
• Unexplained traffic spikes, slow pages, or a hosting bill that jumped
• Your domain sending spam, or mail bouncing because your domain was blocklisted
• Files on the server with recent dates that no deployment explains

The first hour

1. Call for help first. If your site is managed, open a P1 ticket and phone your provider. Incidents get worse while people fix symptoms on their own.
2. Write down what you saw and when. Screenshots, URLs, times, who noticed. This record matters later for the investigation and any notifications.
3. Contain, do not destroy. Put the site in maintenance mode or take it offline if it is harming visitors, but do not delete files, accounts, or logs. They are the evidence of how the attacker got in.
4. Change the keys from a clean device. Reset passwords for CMS administrators, hosting and cloud consoles, DNS, and the email accounts of administrators, using a device you trust. Revoke API keys and sessions where you can.
5. Check the accounts that can change everything. Domain registrar, DNS, and cloud root accounts. An attacker who holds these can undo any cleanup.
6. Bring in the right people. Your IT security lead, and early on your legal, privacy, or compliance contact if personal data might be involved.

Mistakes that make it worse

• Cleaning only what you can see. Visible damage is the symptom; the backdoor is the cause. Without finding the entry point, the attacker returns.
• Restoring over the compromised site. Restoring a backup on top of the infected environment destroys evidence and may restore the backdoor too. Restore into a clean, parallel environment instead; see backups and ransomware recovery.
• Restoring the most recent backup without checking. Attackers are often inside for days or weeks before anyone notices. The right restore point is from before the intrusion.
• Going live before the hole is closed. Patch the plugin, module, or server that let them in, and rotate credentials, first.

Notes by platform

WordPress: most compromises come through a vulnerable plugin or theme, or a stolen administrator password; compare plugin files against clean copies and check for unknown administrator users. Drupal: check recent security advisories for core and contributed modules, look for unexpected users and roles, and review recent configuration changes. Cascade: because published pages are generated from Cascade, cleanup usually means fixing the source in Cascade and republishing, plus checking the hosting server and CDN for files that did not come from Cascade.

Notifications

If personal data may have been exposed, notification rules may apply, with deadlines that start when you discover the breach. US states each have breach notification laws, and some sectors have their own. Government agencies may also have reporting duties to state authorities or to CISA. These decisions belong to your legal and compliance team, which is why they should be in the room within the first hour, not the first week.

How eWay handles incidents

On environments eWay manages, monitoring runs around the clock with automated alerting to an on-call engineer, and incidents are triaged in under 15 minutes. The response follows the steps above: contain, preserve evidence, find the entry point, and recover into a clean parallel environment, with file integrity monitoring and logs helping show what changed. Every P1 incident gets a formal root cause analysis; see resolution notes and root cause analysis.

What to include in a support ticket

• Severity P1, then call as well (see calling support for critical issues)
• What you saw, when, and who noticed, with screenshots and URLs
• Anything already changed or deleted since, so the team knows what evidence remains

eWay customers can open a ticket in the support portal or email support@ewaycorp.com at any time. Related reading: multi-factor sign-in and passkeys and WordPress plugins and Drupal modules.