You often hear people say that a website has been “hacked,” but the term can mean many different things.
In simple terms, a website is hacked when an unauthorized person or automated system gains access to the website, its hosting account, its database, or its server and is able to change, steal, damage, or misuse information or resources.
A hacked website does not always look broken. In fact, some of the most dangerous compromises are designed to remain hidden for as long as possible.
How Does a Website Get Hacked?
There is no single way that websites are compromised.
Years ago, stolen FTP passwords were a common source of website attacks, and they are still a risk today. However, modern websites are much more complex, and attackers can gain access through many different routes.
Common causes include:
- Weak or reused passwords
- Stolen administrator credentials
- Outdated WordPress installations
- Vulnerable plugins or themes
- Compromised hosting accounts
- Insecure FTP or file-transfer credentials
- Malware on an administrator’s computer
- Poorly configured servers
- Vulnerable custom website code
- Exposed database credentials
- Stolen API keys
- Improper file permissions
- Brute-force login attacks
Automated bots continuously scan websites across the Internet looking for known vulnerabilities. A website does not have to be famous or receive large amounts of traffic to become a target.
Many attacks are automated and simply attempt to compromise as many vulnerable websites as possible.
What Happens After a Hacker Gains Access?
What happens next depends on what the attacker wants to accomplish.
An attacker may modify website files, create new administrator accounts, insert malicious JavaScript, change database records, upload hidden programs, or place malicious files somewhere inside the hosting account.
In some cases, the attacker may install what is called a backdoor.
A backdoor is hidden code that allows the attacker to regain access later, even after the original vulnerability or stolen password has been fixed.
This is one reason cleaning a hacked website can be more complicated than simply deleting one suspicious file.
What Can Hackers Do to a Website?
A compromised website can be abused in many different ways.
Redirect Visitors to Other Websites
Attackers may insert code that silently redirects visitors to spam, scam, gambling, counterfeit, or malicious websites.
Sometimes only certain visitors are redirected, which can make the problem difficult for the website owner to notice.
For example, the redirect may appear only for mobile visitors, visitors arriving from a search engine, or users from a particular country.
Display Unwanted or Malicious Content
A hacker may replace the website’s home page, insert advertisements, publish spam pages, or display political, offensive, or fraudulent messages.
This type of visible attack is sometimes called website defacement.
However, many attackers prefer not to change the visible website because remaining unnoticed allows them to continue using the compromised site.
Steal Information
If a website stores sensitive information, attackers may attempt to access databases, customer records, login information, email addresses, or other data.
For an e-commerce website, the potential consequences can be much more serious if customer or payment-related information is exposed.
Website owners should therefore minimize the amount of sensitive information stored on the server and properly protect any data that must be retained.
Distribute Malware
A compromised website can sometimes be modified to deliver malicious software or malicious scripts to visitors.
Modern browsers and security systems provide significant protection against these attacks, but compromised websites can still be used as part of malware campaigns, phishing attacks, or other fraudulent activity.
Create Spam Pages
One increasingly common problem is SEO spam.
Attackers create hundreds or thousands of hidden or automatically generated pages inside a legitimate website.
These pages may advertise pharmaceuticals, gambling, fake products, financial scams, or unrelated services.
The legitimate website owner may not immediately see these pages, but search engines can discover and index them.
This can damage the site’s search rankings and reputation.
Send Spam Email
If attackers gain access to a hosting account or server, they may use it to send large amounts of spam.
This can consume server resources and may cause the server’s IP address or domain name to be placed on email blocklists.
As a result, legitimate email from the website or company may stop reaching customers.
Use the Website to Attack Other Systems
A compromised server can become part of a larger network of infected machines.
Attackers may use it to:
- Scan other servers for vulnerabilities
- Participate in denial-of-service attacks
- Host phishing pages
- Distribute malware
- Attempt password attacks against other websites
- Store illegal or malicious files
In this situation, your website may appear normal while the server is being used for activities you never authorized.
Can a Website Be Hacked Without the Owner Knowing?
Yes.
This is one of the most important things to understand about website security.
Not every attack takes the website offline.
A sophisticated attacker often wants the site to continue operating normally because that makes the compromise harder to detect.
Possible warning signs include:
- New administrator accounts you did not create
- Unexplained files or directories
- Unexpected changes to website code
- Unknown scheduled tasks
- Sudden increases in CPU usage
- Unusual network traffic
- Unexpected database changes
- Spam pages appearing in search engines
- Visitors reporting redirects
- Security warnings from browsers or search engines
- Large amounts of outgoing email
- Hosting providers reporting suspicious activity
Any of these can justify further investigation.
What Is Malware?
Malware is short for malicious software.
In the context of websites, malware can include malicious PHP scripts, JavaScript code, hidden redirects, backdoors, spam generators, credential stealers, or programs designed to give attackers continued access to the server.
Website malware does not necessarily look like a traditional virus on a desktop computer.
It may consist of only a few lines of hidden code inserted into an otherwise legitimate website file.
How Can You Reduce the Risk of Being Hacked?
No website can be guaranteed to be completely immune from attack, but good security practices can greatly reduce the risk.
Use Strong, Unique Passwords
Use long, unique passwords for:
- WordPress administrator accounts
- Hosting control panels
- SFTP or SSH accounts
- Email accounts
- Database management tools
- Domain registrar accounts
Do not reuse the same password across multiple services.
A password manager can make it much easier to maintain strong, unique passwords.
Enable Two-Factor Authentication
Two-factor authentication, often called 2FA, requires a second form of verification in addition to a password.
This can prevent many account takeovers even if a password is stolen.
2FA is especially important for administrator, hosting, email, and domain registrar accounts.
Keep WordPress Updated
If you use WordPress, keep the WordPress core software, themes, and plugins current.
Security vulnerabilities are regularly discovered in web software.
When developers release security fixes, attackers may quickly begin scanning the Internet for websites that have not yet installed those updates.
Unused plugins and themes should normally be removed rather than simply left disabled.
Use SFTP or SSH Instead of Traditional FTP
Traditional FTP can transmit usernames and passwords without adequate encryption.
Whenever possible, use SFTP or another encrypted file-transfer method.
SFTP stands for SSH File Transfer Protocol and protects the connection between your computer and the server.
Back Up Your Website Regularly
Backups are one of the most important parts of website security.
A good backup strategy should include both website files and databases.
It is also wise to keep at least one backup copy somewhere separate from the live server.
If the only backup is stored inside the compromised hosting account, an attacker may be able to delete or modify it as well.
Scan and Monitor the Website
Security tools can monitor websites for unexpected file changes, malware, suspicious login attempts, and other unusual activity.
Monitoring does not replace updates and secure configuration, but it can help detect problems earlier.
Protect Your Own Computer
Sometimes the website itself is not the original source of the problem.
Malware on a webmaster’s computer can steal saved passwords, browser sessions, FTP credentials, or other login information.
Keeping your own computer updated and protected is therefore part of website security.
Limit Administrator Access
Not every user needs administrator privileges.
Give each account only the permissions required for its job.
If an employee, developer, or contractor no longer needs access, remove or disable that account.
This principle is often called least privilege.
What Should You Do If Your Website Is Hacked?
If you suspect that your website has been compromised, simply changing the password may not be enough.
A proper response may include:
- Taking a backup or forensic copy of the compromised site before making major changes.
- Changing hosting, WordPress, database, email, and administrator passwords.
- Revoking unknown users and access keys.
- Scanning website files for malware and backdoors.
- Checking the database for unauthorized changes.
- Updating WordPress, plugins, themes, and server software.
- Removing unused software.
- Identifying and fixing the original vulnerability.
- Restoring clean files from a known-good backup when appropriate.
- Reviewing logs for suspicious activity.
- Checking whether search engines or browsers have flagged the site.
- Continuing to monitor the website after cleanup.
The most important step is finding how the attacker got in.
If you remove the malware but leave the original vulnerability open, the website may simply be hacked again.
Can Managed WordPress Hosting Help?
Managed WordPress hosting can reduce some of the maintenance burden associated with running a WordPress website.
Depending on the hosting provider and service plan, managed WordPress hosting may include features such as automatic WordPress updates, backups, malware monitoring, security hardening, server maintenance, and technical assistance.
However, managed hosting should not be treated as a guarantee that a website can never be compromised.
Website owners still need to use strong passwords, protect administrator accounts, keep third-party software under control, and follow good security practices.
A secure website is the result of multiple layers of protection working together.
Website Security Is an Ongoing Process
Website hacking has changed considerably over the years.
Attackers no longer rely only on stealing FTP passwords or manually targeting individual websites. Automated systems can scan millions of websites looking for outdated software, weak passwords, vulnerable plugins, exposed services, and configuration mistakes.
Fortunately, the fundamentals of protecting a website are straightforward.
Keep software updated, use strong and unique passwords, enable two-factor authentication, maintain reliable backups, limit administrator access, use encrypted connections, and monitor the website for suspicious activity.
You may never be able to eliminate every possible security risk, but these basic precautions can dramatically reduce the chances that your website becomes an easy target.