cPanel Credentials Were Stolen: What to Rotate and in What Order
Respond to stolen cPanel credentials by preserving access evidence, securing email, revoking sessions and rotating site, database, mail and DNS secrets.
SPECIALIST DIAGNOSTIC GUIDES
Contain the compromise.
Recover without losing evidence.
Incident-response guides for malicious redirects, unknown accounts, injected scripts, spam pages, suspensions and stolen credentials.
START WITH THE VISIBLE SYMPTOM
Guidance organised around real incidents.
Choose the symptom closest to what you see, collect the evidence and follow a controlled route to verification.
01
Malicious redirects
Preserve evidence and locate conditional redirects across files, data, scripts, DNS and edge rules.
Explore the guides 02Unknown privileged accounts
Map staff, administrator, hosting and integration access before rotating exposed credentials.
Explore the guides 03SEO spam and injected pages
Separate indexed payloads, persistence and the original entry point before requesting removal.
Explore the guides 04Recurring compromises
Find scheduled tasks, data injections and stolen credentials that survive a superficial cleanup.
Explore the guides 05Phishing and spam activity
Contain abusive sending or hosted content while preserving logs needed to define the scope.
Explore the guides 06Safe recovery and monitoring
Restore from trusted sources, close the evidenced entry point and verify integrity over time.
Explore the guidesExplore: Aftercare Recurring Protection
Backups Restoration Verification
Compromis Woocommerce Critic
Compromiso Woocommerce Critico
Confirm And Contain Incident
Confirmar Contener Incidente
Confirmar Contenir Incident
Copias Restauracion Verificacion
Copies Restauracio Verificacio
Encontrar Entrada Persistencia
Find Entry Point And Persistence
Recover Control Safely
Recuperar Control Seguretat
Recuperar Control Seguridad
Trobar Entrada Persistencia
Woocommerce Business Critical Compromise
Read the guide ↗
How to Restore a Hacked WordPress Site Without Restoring the Intrusion
Restore a hacked WordPress site by rebuilding trusted code, validating database and uploads, rotating secrets and importing only assessed data.
WordPress Was Hacked: The First 30 Minutes Without Destroying Evidence
Contain a hacked WordPress site in the first 30 minutes while preserving logs, backups, access evidence, customer safety and a recoverable copy.
How to Confirm a WordPress Site Is Compromised Before Taking It Offline
Confirm a suspected WordPress compromise using reproducible symptoms, clean-browser checks, hosting logs, file integrity and account evidence.
A WordPress Administrator Appeared Without Permission
Respond to an unknown WordPress administrator by preserving evidence, disabling access, auditing creation paths, rotating credentials and finding persistence.
The WordPress Login Page Works but Every Password Has Changed
Recover safely when WordPress passwords stop working by checking account changes, email ownership, database integrity, sessions and hosting control.
Visitors Are Redirected Only from Google Search Results
Investigate conditional WordPress redirects affecting search visitors through clean tests, redirect chains, PHP, database, DNS, CDN and persistence.
A WooCommerce Store Shows Unknown Checkout Code
Respond to unknown WooCommerce checkout code by containing payment risk, preserving evidence and auditing files, database, tags and payment settings.
WordPress Sends Spam Email from the Hosting Account
Contain WordPress spam sending by preserving mail logs, identifying the script or account, cleaning persistence, rotating access and repairing reputation.
The Hosting Provider Disabled a Hacked WordPress Site
Recover a host-disabled WordPress site by preserving the suspension report, obtaining safe backups, cleaning offline and meeting reopening evidence.
Multiple Sites in One cPanel Account Were Hacked Together
Contain several hacked WordPress sites in one cPanel account by mapping shared access, preserving evidence, rebuilding and separating future risk.
What Information to Preserve Before an Emergency WordPress Repair
Preserve the minimum useful WordPress incident evidence: timeline, logs, backups, accounts, files, database state, DNS, mail and business impact.