A hacked website is one that someone other than you has taken control of, usually without anything showing on the surface. This article explains how we detect it, why we sometimes take your site offline, and what needs to be done to put it back online safely.
In short
We take the site offline to protect your visitors, not to penalise you. It stays offline until it has been cleaned, and a simple restore is not always enough. Your mailboxes are not affected by the site being taken offline.
What an attacker does with a website
On PHP/MySQL hosting, a hacked site is almost always used for something other than harming you directly:
- publishing fraudulent advertising pages (pharmacy, casinos, counterfeits) that only search engines see;
- redirecting your visitors to scam sites or to malware;
- sending spam or hosting phishing pages (fake bank or delivery pages);
- installing their own tools so they can come back later, even after a password change.
Your site can therefore look normal to you while being flagged as dangerous by Google or by web browsers.
How we detect it
We monitor our hosting servers. We step in in particular when we see:
- files whose content matches known hacking tools;
- administrator accounts created recently, with no apparent link to you;
- a mass sending of emails or requests from your site;
- a report from a security organisation or a blocklist.
We notify you through a ticket describing what we found.
Why we take the site offline
When the attack is still under way, we disable the site. It then shows an error page. This measure serves to:
- protect your visitors, who must not be redirected or infected;
- protect your domain's reputation: a site that spreads malicious content ends up on blocklists, and getting off them takes time;
- protect the other sites hosted on the same server, which share its resources and its IP address.
Taking the site offline only concerns the website. Your email keeps working normally.
Domain in .ch or .li: the SWITCH alert
SWITCH, the registry for .ch and .li domain names, checks reports of hacked websites. When it finds that a site is being used for phishing or spreads malware (for example "drive-by" code, which tries to infect visitors' computers without them even clicking), it sends an email titled "Misuse of your website" from saferinternet@switch.ch to the domain holder, the technical contact, the registrar and to us, the hosting provider. This email is genuine: act on it straight away.
SWITCH's procedure, based on the Swiss Ordinance on Internet Domains (OID, art. 15) and also applied to .li domains, is as follows:
- One working day to clean the site. The email contains a link to the incident details and the affected addresses.
- If the site is not cleaned in time, SWITCH deactivates the domain name for up to 5 working days. A deactivated domain does not only take the website down: every email address on the domain stops working too.
- When the domain is reactivated, SWITCH asks the holder to prove their identity and to give a correspondence address in Switzerland, within 10 days.
- Without an answer in that time, and if the site is still infected, SWITCH permanently deletes the domain name.
How we handle it
- We forward the alert to you immediately, with the deadline set by SWITCH and the link to the incident status.
- You choose: either we suspend the site right away, or you confirm that your webmaster is cleaning it before the deadline, and the site stays online under watch. You can also have us clean it: this is a paid service, quoted in advance, and the site stays suspended until the work is done.
- If we have not heard from you before the deadline, we suspend the site ourselves. The site becomes unreachable, but the domain name stays active and your email keeps working. For SWITCH, a suspended site no longer poses a danger: the domain is not deactivated.
- Once the site is clean, let us know. We ask SWITCH for a new check from their status page, then reactivate the site.
SWITCH describes the full procedure on nic.ch.
How the intrusion happened
In the vast majority of cases, the attacker got in through:
- software that is no longer up to date: WordPress, Joomla, a plugin or a theme with a vulnerability known for months;
- a weak or reused password, for the site's administration or for FTP access;
- a forgotten old site left online in a subfolder (
old, test, backup…) that nobody updates any more;
- an infected computer that leaked your FTP credentials.
Why a restore is not always enough
An intrusion is often discovered several weeks after it happened. If all our backups date from after the intrusion, restoring the site would put the attacker's tools back along with your pages.
In that case, the site has to be reinstalled cleanly: fresh, up-to-date software, then your content (text, images, database) brought back piece by piece after checking. It takes longer than a restore, but it is the only way to be sure the attacker does not come back the next day.
When a backup from before the intrusion exists, we tell you: putting the site back is then simpler. See also Backups: how to restore data.
Your options
You have a choice:
- Have us restore the site. We reinstall the site, bring back your content, remove the attacker's access, change the passwords and put the site back online. This is a paid service: we send you a quote before starting.
- Call on your webmaster or your agency. Tell us in the ticket: we give them the access they need, and the site stays offline until they have finished.
- Do it yourself, if you have the skills. For a WordPress site, the steps are described in WordPress: cleanup after a hack.
In every case, the site only goes back online once it is clean.
What we will ask you
To move forward, we often need your answer on a few points:
- Administrator accounts: do you recognise each of them? An account that nobody recognises is deleted.
- Old folders: can an old version of the site still on the hosting be deleted?
- Your access: who other than you (agency, former provider) has the passwords for the site or for FTP?
Simply reply to the ticket: your answer goes straight to the team handling your case.
What to do on your side, right now
- Change the passwords you use elsewhere if they are the same as for this site.
- Scan your computer with an up-to-date antivirus, especially if you connect to the site over FTP.
- If your site collected personal data (contact forms, sign-ups, online shop), it may have been accessed. Check your obligations under the Swiss Federal Act on Data Protection: a breach that poses a high risk to the people concerned must be reported to the Federal Data Protection and Information Commissioner (FDPIC).
Preventing it from happening again
Once the site is back online, a few habits are enough to keep most attacks away:
- update the site's software, plugins and themes, or turn on automatic updates;
- remove what is no longer used: disabled plugins, unused themes, old copies of the site;
- use a long, unique password for each access, and two-factor authentication for the administration;
- keep a supported PHP version, which still receives security fixes.
For WordPress, the details are in WordPress: securing your WordPress site.
Any questions?
Reply to the ticket we sent you, or open a new request mentioning the domain name of the site concerned.