Overview
Website and email accounts are the two most common targets for attackers. Most compromises happen for the same handful of reasons — and most are preventable. This article explains the common causes and how to protect yourself.
Part 1: Common Website Compromise
How Websites Get Hacked
| Cause | What Happens |
|---|---|
| Outdated CMS/plugins/themes | WordPress, Joomla, and plugins with known vulnerabilities are exploited |
| Nulled/pirated plugins & themes | Contain hidden backdoors planted by the uploader |
| Weak admin passwords | Brute force attacks guess simple passwords |
| Compromised hosting account | Breached cPanel/FTP gives access to all sites |
| Malicious uploads | Contact forms or file uploads allow attackers to inject scripts |
| Outdated PHP version | Runs code with known security holes |
| Hidden admin users | Attackers create accounts to keep re-entering |
| Backdoors left behind | Even after cleanup, hidden files let them return |
| Insecure third-party scripts | Old plugins or embeds with vulnerabilities |
Signs Your Website Is Compromised
- Unfamiliar files or folders in your hosting account
- Website redirects to another site
- Google warns "This site may be hacked"
- Sudden drop in traffic or SEO ranking
- Strange admin accounts you didn't create
- Spam emails sent from your domain
- Slow performance or high resource usage
How to Prevent Website Compromise
- Keep WordPress core, themes, and plugins updated
- Never use nulled or pirated software
- Use strong, unique passwords for admin, cPanel, and FTP
- Enable two-factor authentication (2FA)
- Install a security plugin (Wordfence, Sucuri)
- Set correct file permissions (folders 755, files 644)
- Use a Web Application Firewall (WAF)
- Remove unused themes and plugins
- Run regular malware scans
- Keep regular backups off-server
Part 2: Common Email Compromise
How Email Accounts Get Hacked
| Cause | What Happens |
|---|---|
| Weak passwords | Easily guessed or brute-forced |
| Phishing attacks | Credentials entered on fake login pages |
| Reused passwords | A breach on another site exposes your email login |
| Insecure devices/networks | Public Wi-Fi or infected devices capture credentials |
| Third-party app access | Malicious apps with excessive permissions |
| Compromised website | Hacked scripts send spam through your mail server |
| Persistent attacker | Recreates forwarding rules even after removal |
Signs Your Email Is Compromised
- Suspicious forwarding rules you didn't create
- Contacts receiving spam or phishing emails from you
- Emails in your Sent folder you didn't send
- Login alerts from unknown locations
- Missing or deleted emails
- "Max defers and failures" errors on your domain
- Unexpected password reset emails
How to Prevent Email Compromise
- Use strong, unique passwords for every email account
- Enable two-factor authentication (2FA)
- Never reuse passwords across services
- Watch for phishing — check sender addresses before clicking
- Review forwarding rules and autoresponders regularly
- Revoke third-party app access you don't use
- Avoid logging in on public or untrusted networks
- Check login activity periodically
- Keep your website scripts updated (hacked scripts send spam)
Part 3: What to Do If Compromised
If Your Website Is Hacked
- Take it offline temporarily
- Change all passwords — WordPress, cPanel, FTP, database
- Update everything — core, themes, plugins
- Scan for malware and remove backdoors
- Check for hidden admin users
- Restore from a clean backup if needed
- Rebuild from scratch if hacks keep repeating
If Your Email Is Hacked
- Change your password immediately
- Check and remove forwarding rules
- Review login activity for unauthorized access
- Revoke third-party app access
- Scan your devices for malware
- Warn your contacts if spam was sent from your account
Part 4: Need Help?
If your website is being compromised, open a support ticket with Nocser.net immediately.
