Stay calm and work in order. The goal is to stop the damage, remove every piece of the attack and close the way in, so it does not come back.
- Contain
Turn on maintenance mode if customers' payment data may be at risk (card skimmers on the checkout). Change the admin passwords. Open a ticket marked urgent.
- Keep evidence
Do not delete files yet. Download the files and database as they are now: we need them to find how the attacker got in.
- Scan
Run WhizzyScan and the malware scan. They list infected files, injected database content (CMS blocks, configuration) and unknown admin users.
- Find the way in
Usually an old extension, an unpatched store version, a leaked password or an SFTP account that should not exist. Check the access logs around the time of the first infected file.
- Clean
Restore clean files from before the infection (restore files only) or replace the code from your repository. Remove injected content from the database. Delete unknown admin users and SFTP users.
- Close the hole
Update the store and the vulnerable extension, apply security patches, rotate every password and key (admin, database, SFTP, API, payment).
- Check again
Run the scans again, test the checkout, watch the logs for a few days.
If card data may have been stolen, your payment provider must be told. Ask us for help with the timeline from the logs.
We clean hacked stores. Open a ticket; cleaning and patching is done with support hours.
Did this solve it? If not, tell us what you see and we look at your server.
Open a ticket