A West Palm Beach, FL, roofing contractor discovers visitors are being sent somewhere unfamiliar. A med-spa notices its appointment page is producing junk submissions, though payments aren’t taken through their site. A law office notices something strange happening with their intake form that should only be collecting basic contact details.
While the above examples are quite different, they’re all discovering, likely on Monday morning, that their service-based small business website may be hacked.
If you’re dealing with this right now, hopefully, this resource will help. Let’s dig into what to do if your business site has been hacked.
Signs That Something Isn’t Right
There are a couple of common ways a website gets hacked, and they can be summed up by two words: redirects and/or spam. Redirects may be inconsistent and occur for certain browsers/devices/search engines but not for others. Spam may appear to be filling up quote/contact/appointment forms or, unfortunately, may prevent them from working altogether.
In either situation, it’s important to make sure it IS hacked and it’s not something else. Log out of your website and load up your homepage. Look for any redirects, and check your contact/quote/appointment forms for any spammy submissions. Now, visit each of those forms and fill them out and submit to see if they’re working. Take notes of anything out of the ordinary.
Don’t Start Deleting Things
In my experience, the temptation is to dig around and start deleting things. Resist this urge. You may be deleting files; you need to figure out what happened, or, worse, you may be making your site not work. If there are redirects happening, consider setting up a maintenance page to avoid taking customers through anything sketchy.
Lock Down the Restored Site
- Update everything. This includes the core content management system, themes, plugins, and extensions. Attackers are looking for KNOWN security vulnerabilities, so the best defense is to make sure you’re using the latest and greatest version of everything. If you’re not sure how to update everything, reach out to your web designer/developer. They should be able to assist with this.
- Hire a web designer/developer to do this for you if you don’t have someone in your corner. If you’re considering professional help, Studio 47 Web Design is one option. If you’ve gotten this far, your site may be okay. But you need someone in your corner so you’re not doing this again soon. This should be someone who understands how to update everything (above), perform scans for malware, and restore from backup. There are services for this, or you can work with a web design firm. Either way, if you’ve been hacked, you need someone who understands what happened and how to make sure it doesn’t happen again.
- Perform a scan for malware (click here to know more). There are lots of services that will scan for malware. Your hosting company may have some tools available, and there are other tools available to look for vulnerabilities. Whatever route you take, make sure you’re scanning for anything sketchy.
- Double-check admin logins. It’s common for malicious code to be added to your theme, a database record, a form-filling extension, or a plugin that hasn’t been used or updated in some time. Make sure you’re scanning through each of those spots for anything out of the ordinary. You can also hire a company to scan your site for malware (see bullet above).
- Update your passwords. This means your website logins, web hosting logins, email logins, and anything that touches your website should be reviewed. Make sure you’re not sharing passwords between services. It’s also a good idea to make sure there aren’t any admins that shouldn’t be there. Perhaps a former employee or web designer still has a login? Remove them.
- Test forms. If you’ve gotten this far, you’re in the home stretch. Make sure your site is working the way it’s supposed to by submitting a test quote/contact/appointment. Do this for each form. If they’re not working, you’re not done. Reach out to your web designer/developer for assistance.
- Determine next steps. In some instances, a hacked site could reveal customer information. This may mean you’re responsible for notifying those people. Determine what information was at risk, and, from there, what needs to happen.
Keep the Same Trouble from Coming Back
- Update everything regularly. The content management system, any calendar/appointment extensions, any page builders, themes, plugins, and extensions. Keep an eye on these to make sure they’re being updated. It’s also important to know which ones are abandoned and need to be replaced with something actively managed. When performing updates, make sure you’ve got a backup and check for any conflicts.
- Use HTTPS. An SSL cert is an inexpensive way to show customers their information is safe when submitting to your site. It’s important to note that HTTPS will NOT stop bots/spam from filling up your forms; however, it’s a good idea to have HTTPS (https://en.wikipedia.org/wiki/HTTPS) on your website, as it’s an extra layer of encryption between your customer’s browser and your business.
- Beef-up your forms. Forms are a common entryway for bad actors. Using a combination of plugins/extensions can help you avoid bots, identify humans, limit the number of submissions coming from one location, and notify admins of strange submissions. There’s a number of tools to help you identify spammy form submissions before they become a problem.
- Monitor your site. Waiting until Monday morning to figure out your site’s been hacked isn’t fun and likely means you’ve lost weekend quote requests. Monitoring for malware, unexpected changes, and uptime can save you some headaches. Make sure, whoever is monitoring your site, you’re getting actionable notifications to the right place, such as a monitored email inbox, not buried in someone’s personal email.
Customer Trust Is Part of the Damage
Your website should be an extension of your brand and business. When it’s hacked, you’ve not only lost a functioning website, you’ve lost a piece of customer trust.
