Search results show pages you never wrote, browsers warn visitors, or the host has suspended the account. The instinct is to delete the offending files and continue. That reliably leads to reinfection within days, because the attacker retains whatever access they used originally plus whatever they added afterwards.
01Contain before cleaning
Take the site offline or into maintenance mode. Continuing to serve compromised pages damages your search reputation, risks visitors, and gives the attacker continued use of your infrastructure while you work.
Preserve evidence before deleting anything. Copy the web root and the logs to somewhere isolated. Once files are removed, the record of how the attacker entered is gone, and without that you are cleaning symptoms indefinitely.
| Step | Purpose |
|---|---|
| Take the site offline | Stop harm to visitors and reputation |
| Snapshot files and logs | Preserve evidence of entry |
| Find the entry point | Without it, cleanup is temporary |
| Rotate every credential | Assume all secrets are known |
| Rebuild from a known-good source | Faster and safer than cleaning |
| Restore content selectively | Avoid reintroducing the backdoor |
| Patch, then bring it back | Close the door before reopening |
02Find how they got in
Access logs around the time the first unfamiliar file appeared usually reveal the vector: repeated requests to an administrative endpoint, a POST to a vulnerable plugin path, or a successful login from an unexpected location. File modification times narrow the window to search.
The common vectors are a small set - an outdated plugin or component with a known vulnerability, weak or reused administrative credentials, a compromised hosting or FTP account, or an upload feature that permitted executable files. Identifying which one is what makes the fix durable.
03Rebuild rather than disinfect
Attackers routinely install multiple backdoors in unrelated locations - a modified core file, an innocuous-looking file in an uploads directory, an added administrative account, a scheduled task. Finding all of them by inspection is unreliable.
Reinstall the platform and all components from official sources at current versions, then reapply your own code from version control. Move only content and uploaded media across, and inspect uploads for executable files, which have no legitimate reason to be there.
| Location | Form |
|---|---|
| Uploads directory | Script files among images |
| Modified core or plugin files | A few injected lines |
| Database content | Injected scripts in stored posts or options |
| Scheduled tasks | Jobs that re-download the payload |
| Administrative users | Accounts added by the attacker |
| Server configuration files | Rules that execute or redirect |
04Rotate every credential
Assume everything reachable from the compromised system is known to the attacker: database passwords, API keys, mail credentials, hosting and FTP logins, administrative accounts and any secret in a configuration file.
Rotate all of them, and terminate existing sessions so tokens issued before the compromise stop working. Restoring a site while leaving the original database password in place leaves an obvious route back in.
05Close the loop with the search engines
Once clean and patched, request a review through Search Console so warnings are removed. Check for injected content that persists in the database - spam links in posts, altered site options, redirect rules - since these keep the site flagged even after the files are clean.
Then address the cause structurally: automatic updates for security releases, multi-factor authentication on all administrative accounts, removal of unused plugins and themes, file integrity monitoring, and backups stored outside the server. Compromise is usually the result of deferred maintenance rather than a sophisticated attack.
Topics
Marcus Hale
Security Lead · SyncTrix
Writes about the engineering decisions behind production systems - architecture, delivery and the trade-offs that only show up at scale.
Building something like this?
SyncTrix engineers AI, SaaS, platform and cloud systems for enterprises and high-growth teams. Tell us what you're shipping and we'll scope it with you.
Talk to an engineer