Has My Website Been Hacked? First Actions & Checklist
Realizing that your website might have been hacked is a stressful moment. Immediate, structured action is critical to limit data loss, secure user sessions, and restore your services.
---
Indicators that Your Site Has Been Compromised
1. Unusual Traffic Spikes or Drops: Sudden bandwidth spikes could indicate database exfiltration or malware distribution. 2. Scary Browser Warnings: Google Chrome showing "This site contains malware" warnings. 3. Unexpected Open Ports: Finding administrative interfaces (like Port 22 or 3389) or database ports open publicly. 4. Spam DNS Records: Unauthorized subdomains appearing in your DNS settings.
---
Immediate Action Checklist
- Step 1: Change all administrative credentials and database credentials immediately.
- Step 2: Scan your domain for exposed backend database ports.
- Step 3: Review DNS records to ensure no rogue subdomains point to malicious servers (Subdomain Takeover check).
- Step 4: Deploy firewall rules blocking all public ports except 80 and 443.
---
Perform an Emergency Audit with Mangudai
Mangudai scans your systems for open ports, dangling DNS records, and SSL errors, giving you instant insight into exposed attack vectors.
Secure Your Perimeter Today
Identify your exposed assets, subdomains, open ports, and SSL vulnerabilities before malicious actors find them.
Check Your Domain for Free