What do I do if my web site is hacked?

First we need to ensure that you web site has truly been hacked.

If the site is offline, that is, you cannot see it, in all probability the web hosting server is down. Wait for a few hours and the site would be up and running again. Else, you can always contact the technical staff of your web hosting company to confirm if the server is offline.

You don't see your homepage any more - in fact there is some other page being displayed when you check your web site

This is much more of a concern. But before we jump to conclusions, check the URL in the browser. Is it of your web site? If so, we have problems! Someone has gained access to your web hosting account and has replaced your homepage with something else.

You now need to check if you can still connect to your web site using FTP. Try that. If your login is successful, put your web site files back online and go to the control panel provided by your web host and change your password. You can find more information on how to formulate a better password below. IMPORTANT: Send an email to your web hosting company and inform them of the hacking attack.

If you cannot connect to your web site or log in to your control panel, you have to contact your web hosting company. The hacker attack has changed your password and you need to get a new one. The hacker might have also changed your email address associated with your account at the web hosting company but this is unlikely because the password and the email information are generally segregated.

Any way, depending on the company policies, a web hosting firm would either send you a new password over email OR revert with what they need to send you a new password (because they need to verify that the new password request is legitimate). In some cases, you might need to send a fax because the hackers have messed up your email too!

How to formulate a good password

It is of prime importance to keep passwords, pin codes, etc. as complex as possible. For instance, my passwords are not only long but also contain both alphabet and numbers with a good mix of upper and lower case letters. Do not keep obvious passwords such as spouse name, birth date etc.