Noticed in webmaster tools that my site may have been hacked. What is the best way to check if this is the case.

I can see that there are some strange URL injections on my site? How do I find where these are located so that I can remove them?


Totally agree re answer for Phil Taylor's service.

You have 3 "tasks": recovery (back to before the hack), review (to work out how it happened) and revise (okay, rubbish alliteration - but this one's about change your environment to reduce the chance of its happening again or even simply detect it quicker).

So, you should save away the web server (Apache/IIS/whatever) logs for further analysis, especially on shared hosting where the logs may be deleted during rotation within a short space of time. If it's your own server, save the other logs too if possible.

Given you are aware of the hack, whatever the Webmaster tools alerted you to [I think it would be helpful for others if you update the question with an outline of what the Tools said], it is possibly identifiable in the server logs. You could see the originating IP but even if you do, forget it, they're probably using a bot or TOR or some other obfuscation technique and even if they weren't the jurisdiction they're in may not care you have been hacked, sorry. But looking at the logs may at least give you a clue as to how they got in to help clean up and prevent in future.

It's probable that this event may make you review your future backup strategy.....(I did when it happened to me!)


As far as I know, the very best solution is to pay 5GBP and use Phil Taylor's myJoomla service https://mysites.guru/ (formerly myjoomla.com). There are many other "free" solutions, but IMHO Phil is the best! I have no time/energy to list free solutions. Sorry.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.