Webmaster Central Blog
Official news on crawling and indexing sites for the Google index
My site's been hacked - now what?
maanantaina, huhtikuuta 07, 2008
Written by Nathan Johns, Search Quality Team
All right, you got hacked. It happens to many webmasters, even despite the hard work you devote to prevent this type of thing from happening. Prevention tips include keeping your site updated with the latest software and patches, creating an account with
Google Webmaster Tools
to see what's being indexed, keeping tabs on your log files to make sure nothing fishy's going on, etc. (There's more information in the
Quick Security Checklist
we posted last year.)
Remember that you're not alone—hacked sites are becoming increasingly common. Getting hacked can result in your site being infected with badware (more specifically malware, one type of badware). Take a look at
StopBadware
's recently released report on
Trends in Badware 2007
for a comprehensive analysis of threats and trends over the previous year. Check out
this post
on the
Google Online Security Blog
which highlights the increasing number of search results containing a URL labeled as harmful. For even more in-depth technical reports on the analysis of web-based malware, see
The Ghost in the Browser
(pdf) and this
technical report
(pdf) on drive-by downloads. Read these, and you'll have a much better understanding of the scope of the problem. They also include some real examples for different types of malware.
The first step in any case should be to contact your hosting provider, if you have one. Often times they can handle most of the technical heavy lifting for you. Lots of webmasters use shared hosting, which can make it difficult to do some of the things listed below. Certain tips labeled with an asterisk (*) are cases in which webmasters using shared hosting will most likely require assistance from their hosting provider. In the case that you do have full control over your server, we recommend covering these four bases:
Getting your site off-line
Take your site off-line temporarily, at least until you know you've fixed things.*
If you can't take it off-line, return a
503 status code
to prevent it from being crawled.
In the Webmaster Tools, use the
URL removal tool
to remove any hacked pages or URLs from search results that may have been added. This will prevent the hacked pages from being served to users.
Damage Assessment
It's a good idea to figure out exactly what the hacker was after.
Were they looking for sensitive information?
Did they want to gain control of your site for other purposes?
Look for any modified or uploaded files on your web server.
Check your server logs for any suspicious activity, such as failed login attempts, command history (especially as root), unknown user accounts, etc.
Determine the scope of the problem—do you have other sites that may be affected?
Recovery
The absolute best thing to do here is a complete reinstall of the OS from a trusted source. It's the only way to be completely sure you've removed everything the hacker may have done.*
After a fresh re-installation, use the latest backup you have to restore your site. Don't forget to make sure the backup is clean and free of hacked content too.*
Patch any software packages to the latest version. This includes things such as weblog platforms, content management systems, or any other type of third-party software installed.
Change your passwords -
https://www.google.com/account
s/PasswordHelp
Restoring your online presence
Get your system back online.
If you're a Webmaster Tools user, sign in to your account
If your site was flagged as having malware, request a review to determine whether your site is clean
If you used the URL removal tool on URLs which you do want in the index, request that Webmaster Tools re-include your content by revoking the removal.
Keep an eye on things, as the hacker may try to return.
Answers to other questions you may be asking:
Q: Is it better to take my site off-line or use robots.txt to prevent it from being crawled?
A: Taking it off-line is a better way to go; this prevents any malware or badware from being served to users, and prevents hackers from further abusing the system.
Q: Once I've fixed my site, what's the fastest way to get re-crawled?
A: The best way, regardless of whether or not your site got hacked, is to follow the
Webmaster Help Center guidelines
.
Q: I've cleaned it up, but will Google penalize me if the hacker linked to any bad neighborhoods?
A: We'll try not to. We're pretty good at making sure good sites don't get penalized by actions of hackers and spammers. To be safe, completely remove any links the hackers may have added.
Q: What if this happened on my home machine?
A: All of the above still applies. You'll want to take extra care to clean it up; if you don't, it's likely the same thing will happen again. A complete re-install of the OS is ideal.
Additional resources you may find helpful:
If your site's been flagged by Google as serving malware, we'll
alert you
when you visit
Webmaster Tools
.
Don't forget about the
Google Webmaster Help Group
; it's full of extremely knowledgeable users, and Googlers as well. For a nice, on-topic example, check out
this thread
. There's also a
Stop Badware group
.
Matt Cutts recently posted
Three tips to protect your WordPress installation
on his blog, and there are lots of great comments below the post as well.
Feel free to leave additional tips you have in the comments.
Hey!
Check here if your site is mobile-friendly.
Tunnisteet
accessibility
10
advanced
195
AMP
13
Android
2
API
7
apps
7
autocomplete
2
beginner
173
CAPTCHA
1
Chrome
2
cms
1
crawling and indexing
158
encryption
3
events
51
feedback and communication
83
forums
5
general tips
90
geotargeting
1
Google Assistant
3
Google I/O
3
Google Images
3
Google News
2
hacked sites
12
hangout
2
hreflang
3
https
5
images
12
intermediate
205
interstitials
1
javascript
8
job search
2
localization
21
malware
6
mobile
63
mobile-friendly
14
nohacked
1
performance
17
product expert
1
product experts
2
products and services
63
questions
3
ranking
1
recipes
1
rendering
2
Responsive Web Design
3
rich cards
7
rich results
10
search console
35
search for beginners
1
search queries
7
search results
140
security
12
seo
3
sitemaps
46
speed
6
structured data
33
summit
1
TLDs
1
url removals
1
UX
3
verification
8
video
6
webmaster community
24
webmaster forum
1
webmaster guidelines
57
webmaster tools
177
webmasters
3
youtube channel
6
Archive
2020
marrask.
lokak.
syysk.
elok.
heinäk.
kesäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2019
jouluk.
marrask.
lokak.
syysk.
elok.
heinäk.
kesäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2018
jouluk.
marrask.
lokak.
syysk.
elok.
heinäk.
kesäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2017
jouluk.
marrask.
lokak.
syysk.
elok.
kesäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2016
jouluk.
marrask.
lokak.
syysk.
elok.
kesäk.
toukok.
huhtik.
maalisk.
tammik.
2015
jouluk.
marrask.
lokak.
syysk.
elok.
heinäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2014
jouluk.
marrask.
lokak.
syysk.
elok.
heinäk.
kesäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2013
jouluk.
marrask.
lokak.
syysk.
elok.
heinäk.
kesäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2012
jouluk.
marrask.
lokak.
syysk.
elok.
heinäk.
kesäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2011
jouluk.
marrask.
lokak.
syysk.
elok.
heinäk.
kesäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2010
jouluk.
marrask.
lokak.
syysk.
elok.
heinäk.
kesäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2009
jouluk.
marrask.
lokak.
syysk.
elok.
heinäk.
kesäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2008
jouluk.
marrask.
lokak.
syysk.
elok.
heinäk.
kesäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2007
jouluk.
marrask.
lokak.
syysk.
elok.
heinäk.
kesäk.
toukok.
huhtik.
maalisk.
helmik.
tammik.
2006
jouluk.
marrask.
lokak.
syysk.
elok.
Feed
Follow @googlewmc
Give us feedback in our
Product Forums
.
Subscribe via email
Enter your email address:
Delivered by
FeedBurner
