Website Hacked? 7 Immediate Emergency Actions to Take Right Now (Malaysia)

Discovering that your company website has been hacked—whether defaced, redirecting visitors to illicit gambling portals, injecting spam keywords, or leaking customer records—is a high-stress corporate emergency.

The actions your team takes within the first 60 minutes determine whether the incident is a temporary hiccup or a catastrophic breach resulting in permanent Google de-indexing, PDPA regulatory penalties, and reputational collapse.

Here is the exact emergency containment protocol used by JagaWeb engineers to isolate, clean, and restore compromised Malaysian websites.

---

Action 1: Put Up an Emergency Maintenance Page (Isolate Live Traffic)

Do not let compromised code continue executing or infecting visitors. If your site is on Cloudflare or behind a WAF, activate "Under Attack Mode" or configure a 503 Maintenance Page rule immediately.

If you have SSH/cPanel access, rename the root index.php or use an .htaccess rewrite to route all external traffic to a static maintenance notice:

# Emergency .htaccess lockdown (Allow office IP only)
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^203\.106\.102\.15$  # Replace with your actual office IP
RewriteCond %{REQUEST_URI} !/maintenance\.html$
RewriteRule .* /maintenance.html [R=503,L]

---

Action 2: Take Forensic Snapshots (DO NOT Delete Files Yet!)

Panicking and immediately deleting infected files destroys forensic evidence needed to determine the breach vector (how the attacker got in).

Before making any modifications:

1. Export a full database dump:

mysqldump -u db_user -p --single-transaction --routines --triggers db_name > /root/forensic_dump_$(date +%F).sql

1. Compress the entire web root directory:

tar -czpf /root/forensic_webroot_$(date +%F).tar.gz /var/www/html/

1. Capture web server access logs:

cp /var/log/nginx/access.log /root/access_log_$(date +%F).log
cp /var/log/nginx/error.log /root/error_log_$(date +%F).log

---

Action 3: Immediately Rotate Payment Gateway & Third-Party API Keys

If your website processes payments (WooCommerce, Shopify headless, custom Laravel/Next.js) or stores customer leads, attackers frequently exfiltrate API secrets.

Log into each provider dashboard and regenerate:

• Malaysian Payment Gateways: Billplz Secret Keys & X-Signature, ToyyibPay User Secret Key, SenangPay Merchant ID & Secret, Curlec API Keys, Stripe Live Secret Keys.
• Database & Hosting Credentials: MySQL/PostgreSQL root & user passwords, cPanel/WHM master password, SSH private keys.
• Transactional Mail Providers: Postmark, Resend, SendGrid, Mailgun API tokens.

---

Action 4: Invalidate All Active User Sessions & Reset Salts

Attackers maintain access through stolen session cookies or rogue administrator accounts.

1. Delete Rogue Admin Accounts:

# Using WP-CLI for WordPress sites:
wp user list --role=administrator
# Delete any unrecognized admin user:
wp user delete rogue_user_id --reassign=legitimate_admin_id

1. Generate New Security Salts: Visit https://api.wordpress.org/secret-key/1.1/salt/ and replace all AUTH_KEY, SECURE_AUTH_KEY, and LOGGED_IN_SALT values in your wp-config.php. This forcefully logs out every session globally, including the attacker.

---

Action 5: Identify the Infection Vector (Logs & Checksums)

Malware rarely appears out of nowhere. It is almost always introduced via:

1. An outdated or vulnerable plugin / theme.
2. A compromised administrator password (brute-force).
3. "Nulled" (pirated) GPL plugins containing hidden backdoors.

Inspect recent file modifications and search for obfuscated payloads:

# Find files modified in the last 48 hours
find /var/www/html -type f -name "*.php" -mtime -2

# Search for common obfuscated backdoor patterns
grep -rnE "(eval\(base64_decode|gzinflate|str_rot13|assert\()" /var/www/html/wp-content/

---

Action 6: Restore from Clean Offsite Backup vs. Full Core Reinstall

If you maintain verified offsite backups created before the infection date, restoring the clean snapshot is the fastest, safest recovery method.

If no clean backup exists, perform a clean-slate rebuild:

1. Delete all WordPress core files and folders (wp-admin, wp-includes, root *.php).
2. Download fresh, untampered core files from wordpress.org.
3. Manually inspect every folder inside wp-content/uploads/ to ensure NO .php, .js, or .py files exist inside uploads.
4. Reinstall licensed plugins directly from the official repository.

---

Action 7: Request Immediate Google Blacklist & Safe Browsing Review

If Google has already flagged your site with a red "Deceptive Site Ahead" screen:

1. Log into Google Search Console.
2. Navigate to Security Issues.
3. Click Request Review. Provide clear, technical documentation of actions taken (e.g., "Malicious redirect script removed from header.php, core files re-verified via SHA256 checksums, Cloudflare WAF rate-limiting applied, database credentials rotated").
4. Google typically lifts the warning within 24 to 72 hours.

---

Emergency Incident Response Comparison

+----------------------------+-----------------------+-------------------------+
| Step                       | Do-It-Yourself / Slow | JagaWeb Incident S.O.S  |
+----------------------------+-----------------------+-------------------------+
| Containment Response Time  | 6 - 24 Hours          | < 30 Minutes            |
| Forensic Triage & Snapshot | Often Missed          | Guaranteed First Step   |
| Payment Gateway Rotation   | Overlooked            | Systematic Audit        |
| Backdoor Eradication       | Incomplete Re-infect  | 100% Checksum Verified  |
| Post-Incident Protection   | None                  | Cloudflare WAF + Care   |
+----------------------------+-----------------------+-------------------------+

---

Need Urgent Website Recovery in Malaysia?

If your website is currently breached, do not risk further data loss or permanent Google de-indexing.

JagaWeb provides rapid, fixed-price emergency incident response and full platform recovery for Malaysian businesses.

• RM5,000 Ownership, Access & Security Review: We perform a complete forensic cleanup, remove blacklists, close backdoors, and secure your hosting environment.
• RM450/month Managed Care Plan: Proactive 24/7 threat monitoring, daily offsite backups, and automatic emergency recovery.

Contact JagaWeb Emergency Incident Team Immediately.