Is Your Server Hacked? 10 Warning Signs and What to Do in the First Hour

Most hacked servers do not show a ransom note. They quietly send spam, mine cryptocurrency or host a phishing page, and the owner finds out weeks later when the provider or Google complains. If you suspect a problem, speed and a calm order of steps matter more than anything.

Ten warning signs

1. Sudden high CPU or load that you cannot explain, often from a hidden mining process.
2. Unknown processes with random names running as your web user.
3. Outgoing spam or a mail queue that suddenly fills up.
4. Your site redirects visitors to other sites, usually only on mobile or from search results.
5. Files changed that you did not touch, especially new PHP files in upload folders.
6. Unknown user accounts or SSH keys you never added.
7. Logins at strange hours or from unfamiliar countries.
8. Unknown scheduled jobs in cron.
9. Your domain or IP is blacklisted, or a browser shows a red warning page.
10. A provider or hosting abuse notice about attacks coming from your server.

The first hour

1. Do not panic and do not delete things

Deleting files or rebooting can destroy the evidence that shows how the attacker got in. First look, then act.

2. Take a snapshot or copy

If your provider offers snapshots, take one now. It lets you investigate later without the pressure of a live problem.

3. Look at who is logged in and what is running

last -a | head -20
who
ps aux --sort=-%cpu | head -15
ss -tupn | head -30

Look for logins you do not recognise and processes that are busy or connected to unknown addresses.

4. Check for recently changed files and scheduled jobs

find /var/www -type f -name "*.php" -mtime -3 | head -50
crontab -l
ls -la /etc/cron.d /var/spool/cron 2>/dev/null

PHP files changed in the last few days in an upload folder are suspicious.

5. Cut the attacker's access

Change every password that touched the server: SSH, the control panel, databases, FTP and the CMS admin. Remove SSH keys and users you do not recognise. If the server is sending spam or attacking others, block outgoing traffic or take it offline until it is clean.

6. Find how they got in

Cleaning without finding the entry point only buys a few days. The usual causes are an out-of-date CMS or plugin, a weak or reused password, and an exposed admin panel. Check the web server logs around the time of the first suspicious change.

7. Clean or rebuild

For a single hacked website, restoring a clean backup from before the date of the first change and then updating everything is the safest route. If the attacker had root access, the only fully safe answer is to rebuild the server from a fresh image and restore your data from a known-good backup.

Prevention that actually works

• Keep the operating system, control panel, CMS and plugins updated.
• Use SSH keys and disable password logins for root.
• Run a firewall and block repeated failed logins.
• Keep backups off the server and test a restore.
• Monitor the server so unusual load or logins are noticed quickly.

When to ask for help

If you are not sure whether the server is clean, or the attacker had root access, get an expert involved early. Our emergency malware cleanup scans and removes the malware, finds the root cause, hardens the server and sends a report, with a follow-up check 48 hours later. If it is not an emergency, send us a message and we will tell you what we would check first.