What to do if your VPS was hacked: recovery steps and prevention

If you suspect your server has been compromised, stay calm and work in order. The aim is first to stop the damage, then to rebuild from a safe foundation.

Signs of a compromise

• Constantly high CPU or network use (for example crypto-mining) and processes you don’t recognise.
• Users, SSH keys or scheduled tasks (cron) you don’t recognise.
• Content, redirects or spam links on your site that you didn’t add.
• Spam or attack traffic coming from your server; receiving an abuse report about it.
• Changed system files, services that stop for no reason, open ports you don’t recognise.

1. First response: stop the spread

1. In the customer panel change your account password and terminate open sessions.
2. If harmful traffic is leaving the server, consider shutting the server down from the panel. That stops the spam or attack.
3. Open a support ticket right away, explaining the situation and when you noticed it.

2. Preserve evidence and data

• Before wiping the server, take a snapshot; it is evidence for later analysis.
• If needed, copy /var/log logs, website files and a database dump off the server. Do not run executable files you copy; after a compromise files can’t be trusted.

3. Try to understand what happened

last -a | head -20                 # recent logins
sudo journalctl -u ssh --since "7 days ago" | grep -i accepted
ps aux --sort=-%cpu | head          # top CPU users
sudo ss -tulpn                      # listening ports
sudo crontab -l; ls /etc/cron.*     # scheduled tasks
cat ~/.ssh/authorized_keys          # authorised SSH keys

The usual causes are a weak or leaked password, an unpatched web application or plugin, or an exposed admin panel or database.

4. Safe recovery: a clean install

When a server is compromised, a clean install is the most reliable path rather than “trying to clean it”; you can’t see hidden leftovers such as rootkits.

1. From the panel reinstall the operating system (everything on the disk is erased).
2. Harden the new server from scratch with the security checklist.
3. Restore your data from a backup. Make sure the backup is from a date before the compromise, and bring the web application up to date.
4. Renew all passwords (database, application admin, API keys, email) and SSH keys.

5. Prevent a repeat

• Use keys only on SSH, and turn on Fail2ban and the firewall.
• Enable automatic security updates; keep applications and plugins up to date.
• Don’t expose admin panels or databases to the internet.
• Take regular off-server backups and occasionally test restoring them.
• Watch logs; set alerts for unusual CPU or network use.

If you received an abuse report: fixing the problem and replying matters so your service isn’t interrupted (see Reporting abuse).

Start with Melinhost

Taking a snapshot, shutting a server down and doing a clean install from the panel takes minutes. Our support team is with you in a situation like this; see the Support experience page for our contact channels.