Recognise a compromised account

This guide covers the signs that a hosting account, mailbox or Client Area account may have been compromised, and the safe first steps to take.

Before you begin

Files you did not upload, especially files with unusual names, or files inside the website folder that you do not recognise.
Sudden high bandwidth or resource use that you cannot explain. See Resource usage and logs.
Visitors being redirected to unfamiliar sites.
Email sent from your address that you did not send, or bounce messages for mail you did not send.
Sign-in notices for times or places you do not recognise.

Any one of these can have an innocent cause, such as an old plugin or a shared computer. Treat several together as a serious warning.

Change the passwords for the affected Client Area, hosting panel, FTP, database and mailbox accounts. Change them from a device you trust.
Sign out of all sessions you can, and turn on two-step verification where offered.
Make a backup of the current state, so the evidence is kept, before you remove anything.
Check the files in your website folder. Compare them with a clean copy of your site or your last known good backup.
Update the software you use, including plugins, themes and the application itself.
Contact support and describe what you saw and when. Support can help with the server side.

Do not delete files without a backup

Removing files before you have a copy can destroy evidence and make recovery harder. Always back up first.

The passwords are changed, the affected software is updated, unknown files are removed or explained, and support has the details.

You cannot change a password. Use Password recovery, then contact support.
The problem returns after cleaning. The entry point may still be open. Review the software and the users who have access, and ask support.
Email is being sent without your knowledge. Change the mailbox passwords first, then read Securing Business Email accounts or Hosting email troubleshooting.

2026-10-27