Signs of Being Hacked

Search engine safety warnings. Content tampered (homepage becomes gambling/porn/political content). Redirect/pop-up to malicious sites. Server anomalies (CPU/RAM/bandwidth spiking). Suspicious new processes or scheduled tasks.

A training institution in 益阳 Heshan District was flagged as dangerous site by search engines during peak enrollment season. Parents saw warning and scrolled past. Estimated loss: 30+ potential enrollments (~90,000 RMB at 3,000 RMB per student average).

Emergency Process

Step 1 Isolate: maintenance mode immediately, pause DNS if severe. Step 2 Preserve evidence: screenshots, export logs, record timeline. Step 3 Clean: restore from clean backup, remove webshells/backdoors, clear malicious DB content. Step 4 Patch: find and fix entry point (weak passwords, unpatched CMS/plugins/frameworks, SQL injection, XSS, file upload flaw, third-party component like Log4j2). Step 5 Recover: take off maintenance mode, submit review request to search engines.

Prevention Basics

Strong passwords (12+ chars, mixed types, different per account). Two-factor authentication. Keep all software updated (CMS/plugins/frameworks/OS). Install WAF. Regular backups (daily auto, offsite storage). Close unnecessary services/ports. Least privilege principle (never run web as root).