BlogLayer

What’s the easiest way to tell you’ve been hacked? Open up your site to discover a vandalized homepage. (Sounds like a joke with a really un-funny punchline.)

Unfortunately, it’s not always that simple. Today’s hackers are clever – and often, their goal is to infiltrate your site without being detected, spreading viruses that collect information, install malware, and infect you and countless other sites and servers. It’s silent and deadly. And if you’re not careful. It can happen to you.

In order to protect your site from stealthy hackers, you have to know where to look. Here’s a helpful checklist that will help you identify the danger signs, and then solve the problem before it gets serious.

You really can’t afford to skip this information. Your site’s safety and credibility is on the line.

How to Tell If You’ve Been Hacked

Check your site code for abnormalities. If you’re not familiar with your site’s internal workings, now is a good time to start. Most hackers target three specific types of files: media files, .php files and .htaccess files. They like to insert hidden malicious links or embed bad code directly into these files – and one of their favorite tricks is encrypting the evil code with base64 encoding. Search your entire site for “base64” and you may find some of these disguised links.

Use security tools in addition to a manual checkup. Here are some of the best security tools to catch anything you missed during your initial code scan.

• Google’s safe browsing checker. Type http://www.google.com/safebrowsing/diagnostic?site=yourdomain.com into your search bar, replacing “yourdomain.com” with your actual domain. This free tool scans your site and provides detailed information about suspicious activity and malware. And it only takes a few seconds.

• Google Webmaster Tools. Install this on your site to get general diagnostics – and click the “Malware” category to see if any malware has been installed on your site.

• Sucuri SiteCheck. This site offers a free manual scan that checks for viruses, spam, malware, phishing and more. If you’re looking for more comprehensive services, they charge $89.99 per year for a complete site-monitoring plan.

• Platform-specific scans. Depending on your site platform, you’ll want to take advantage of specific security checking programs targeted towards WordPress, Joomla or other CMSs (content management systems). WordPress users will appreciate the Explit Scanner, Theme Authenticity Checker or Better WP Security plug-ins, and Joomla sites can install plug-in diagnostic tools like Jamss.php.

How to Clean Up a Hacked Site

Before diving into the clean-up process, make sure you have a complete back-up of your site. Then use your FTP application to find and download all the compromised files. Delete the infected components and then re-upload the clean files, replacing the old, affected code with the cleaned code. Then scan your site again to make sure you caught everything.

Once you’ve cleaned up your files, change all your passwords. No exceptions. Also, visit your server’s scheduler and delete any “jobs” you don’t recognize – sometimes, hackers will use this application to schedule another infection for later. (Nasty little beasts, aren’t they?)

How to Protect Your Site From Future Hackers

Make sure your site is monitored regularly for suspicious activity. (It’s a good idea to choose a hosting provider that offers this service.) You can also use Google Analytics to monitor site traffic and user behavior, and run regular site scans.

Watch out for any unusual or abnormal behavior...unexplained spikes in traffic, traffic from unusual places, lots of new comments on old content.

Stay on top of your security. (Again, a proactive hosting company can handle this issue for you.) Use strong passwords, change them regularly, and keep admin accounts to a minimum. Make sure you protect sensitive files and folders with especially strong passwords.

If you’re using a CMS to manage your site, make sure all your plug-ins and themes are up-to-date. If you’re not using something, delete it, and make sure your core installations are always up to date. (Outdated software is a wide-open door for hackers.)

Remember – it isn’t the end of the world if you get hacked. But you’ll save yourself and your site visitors some major headaches if you keep up-to-date with security. So be proactive. Scan, monitor, and save yourself a ton of trouble.

For more tips on site security, read our article here.