First contain the incident, preserve useful evidence, secure administrator access, identify the affected systems, and recover from a known-good state. Then rotate credentials and secrets, patch the root cause, validate the restored site, and monitor closely for recurrence.
1. Contain without making the situation worse
If possible, place the affected site in maintenance mode or restrict public access while keeping logs and evidence available. Do not randomly delete suspicious files before recording what changed. If customer data or payments may be involved, treat the situation as a business incident, not just a broken webpage.
2. Protect administrator access
Change passwords from a trusted device, enable multi-factor authentication, remove unknown accounts, revoke old sessions, and inspect access to hosting, DNS, domain registration, email, code repositories, databases, and deployment platforms. Compromise can extend beyond the web application itself.
3. Preserve evidence and build a timeline
Save relevant server logs, application logs, suspicious files, timestamps, alerts, emails, and screenshots. Note when the first symptoms appeared and what changed shortly before that. A timeline helps distinguish the cause from the visible damage.
4. Recover from a known-good state
Use a verified backup or clean source repository when possible. Reinstalling a compromised component from the same vulnerable version is not enough. Patch the vulnerability, update dependencies, correct permissions, remove unnecessary software, and validate configuration before reopening the site.
5. Rotate secrets after the environment is clean
Reset database credentials, API tokens, deployment keys, SMTP passwords, webhook secrets, admin passwords, and other credentials that may have been exposed. Rotating too early—before removing persistent access—can simply reveal the new secrets to an attacker who is still present.
6. Retest and monitor
Check the restored site for unexpected users, files, cron jobs, redirects, DNS changes, mail abuse, modified templates, and unauthorized integrations. Monitor logs and alerts closely after recovery and document the lessons that should become permanent controls.