All Collections
Website
Website Security
What to Do if Your Account or Site Has Been Hacked?
What to Do if Your Account or Site Has Been Hacked?

Learning why accounts might get hacked and how to avoid it

Updated over a week ago

Although there are many potential vulnerabilities that can be exploited by hackers, one thing that you do not need to worry about is server security. Our servers have advanced security modules that assure the best possible protection, such as mod_security, Suhosin PHP hardening, PHP open_basedir protection, and others. Check What Security Measures Does Hostinger Use? for more information.

We also have an automatic Malware Scanner that will help identify and remove malicious files on your account.

If you suspect that your account or website was hacked, check the article below for the possible reasons, actions you can take, and how to prevent it.


Why Did It Happen?

The most common reasons are:

  • Outdated web applications - Using older versions of your CMS (WordPress, PrestaShop, Joomla, etc.)

  • Outdated or nulled extensions - Third-party extensions such as plugins, modules, or themes can be vulnerable if outdated. Also, be aware of paid extensions offered for free on unofficial sites, as they may have been modified to include malware

  • Weak, exposed, or breached passwords - Using passwords that are easy to guess, repeating the same password across different services, or using passwords that were publicly posted (for example, if you have it written down on a sticky note at your desk)

  • Infected local computer - Some computer viruses can steal your login information and use it to add malicious code to your web files


What to Do if a Profile or Site Is Hacked?

There are a few things to look for that can indicate a potential hack:

  • Changes on your hosting account or files that were not made by you or someone you have authorized, such as a developer managing your website

  • Unrecognized accesses registered in the Login History of your Account Activity

  • An unexpected increase in your hosting’s resource usage

If you notice these or other unusual changes, the recommended actions are:

  1. Checking your devices for any viruses and malware (you can use Malwarebytes for this)

  2. Checking your browser for any suspicious extensions

  3. Changing the passwords for all of your accounts associated with the site: devices, hosting account, e-mail, FTP access, and so on

  4. For website hacking:

    1. Restoring the website using a backup from a date when it was working perfectly fine and then updating all of your plugins, theme, and CMS itself

    2. Optionally, you can download your website files and check them with an antivirus application

  5. For account hacking:

    1. Change the password of your Hostinger profile and the email you use to log in

    2. If available for you, set up social login

    3. Set up two-factor authentication for both your Hostinger account and the email you use to log in. The application method is highly recommended, as it provides more security

And make sure to report it so we can perform additional checks on our part.


How to Prevent It?

Here are some measures you can take to protect your account and your sites:

  • Never provide your login and password to anyone. If you wish for a developer to manage your website, you can use our Access Manager feature

  • Scan regularly all your devices with up-to-date antivirus and antimalware software

  • Keep your CMS and application extensions updated to the latest version

  • Download extensions/plugins/modules/themes only from trusted sources

  • Always use secure and strong passwords. You can find some useful recommendations here: How to create a strong password?

  • Enable social login for your hosting account, as well as two-step authentication for your CMS admin dashboard

  • And if your website is WordPress-based, here are additional methods to protect it

By following these practices, you will ensure maximum protection for your website!

Did this answer your question?