Guide CloudPanel Site Hacked? How to Find Malware, Clean Up and Lock It Down

Guide CloudPanel Site Hacked? How to Find Malware, Clean Up and Lock It Down - Printable Version

+- AdminsForum (https://adminsforum.com)
+-- Forum: Free & open-source control panels (https://adminsforum.com/Forum-free-open-source-control-panels)
+--- Forum: CloudPanel (https://adminsforum.com/Forum-cloudpanel)
+---- Forum: CloudPanel Guides & Tutorials (https://adminsforum.com/Forum-cloudpanel-guides-tutorials)
+----- Forum: CloudPanel Security Guides (https://adminsforum.com/Forum-cloudpanel-security-guides)
+----- Thread: Guide CloudPanel Site Hacked? How to Find Malware, Clean Up and Lock It Down (/Thread-guide-cloudpanel-site-hacked-how-to-find-malware-clean-up-and-lock-it-down)

CloudPanel Site Hacked? How to Find Malware, Clean Up and Lock It Down - JAY - 10-23-2026

CloudPanel site hacked? How to find malware, clean up and lock it down

Spam pages in Google, visitors redirected to strange sites, a hosting abuse email, or the server suddenly at 100% CPU: these are the classic signs of a hacked site. Don't panic, and don't just delete the one bad file you found. Attackers almost always leave more than one way back in. This guide gives you a calm, ordered way to deal with it on a CloudPanel server.

Step 1: Contain it

Take a copy of the hacked state first (you'll want it to see what happened):
Code:
tar -czf /root/hacked-$(date +%F).tar.gz /home/siteuser
Put the site behind Basic Auth or block all visitors except your IP in the site's Security tab, so it can't infect visitors or send more spam while you work. See CloudPanel site security.
If the server sends spam or attacks others, your provider may suspend it. Tell them you're cleaning it up.

Step 2: Find what changed
Recently changed PHP files (adjust the date to a few days before you noticed the problem):

Code:

find /home/siteuser/htdocs -name '*.php' -newermt '2026-10-01' -type f | head -100

PHP files where they don't belong, such as upload folders:

Code:

find /home/siteuser/htdocs -path '*uploads*' -name '*.php'

Typical malware patterns (this finds suspects, not proof; read each file):

Code:

grep -rlE 'eval\(base64_decode|gzinflate\(base64|str_rot13\(|assert\(\$_(POST|GET|REQUEST)' /home/siteuser/htdocs | head -50

Cron jobs you didn't create (check the site's Cron Jobs tab and):

Code:

crontab -l -u siteuser
crontab -l

Processes and connections that look wrong (crypto miners are common):

Code:

ps aux --sort=-%cpu | head -15
ss -tnp | grep -v '127.0.0.1' | head -30

Users: check CloudPanel's user list, the site's SSH/FTP users, and the WordPress admin users (

Code:

wp user list --role=administrator

).

Step 3: Find out how they got in
Cleaning without closing the hole means you'll be hacked again next week. The usual entry points:

An outdated plugin, theme or app with a known vulnerability (by far the most common).
A stolen or weak password: WordPress admin, SSH, SFTP or the CloudPanel login.
An unpatched PHP version. Make sure PHP is current, for example against PHP2Shell (CVE-2026-109618/109619).

The access log often shows the attack: requests to odd PHP files, many POSTs to one URL, or uploads just before the first bad file appeared:

Code:

grep -E 'POST' /home/siteuser/logs/nginx/access.log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20

Step 4: Clean up (or restore)
Best option: restore a clean backup from before the hack, then update everything right away. See How to restore a site from a CloudPanel backup. Check the backup's date against the first bad file you found; a backup taken after the break-in is infected too.

No clean backup? For WordPress:

Replace core files:
Code:
wp core download --force --skip-content
and check with
Code:
wp core verify-checksums
.
Reinstall every plugin from the official source:
Code:
wp plugin install $(wp plugin list --field=name) --force
and check with
Code:
wp plugin verify-checksums --all
. Premium plugins that aren't on WordPress.org must be downloaded fresh from the vendor.
Replace the theme with a fresh copy.
Go through
Code:
wp-content/uploads
and delete every
Code:
.php
file there.
Check
Code:
wp-config.php
by hand for added code.

For other apps, reinstall the app's code from a fresh download and keep only your data and config.

Step 5: Change every password
Assume everything stored on the server was read: CloudPanel users (clpctl user:reset:password), SSH/SFTP users, database passwords (update the app's config afterwards), WordPress admins, API keys and SMTP passwords in config files. Also generate new WordPress salts in

Code:

wp-config.php

to log everyone out.

Step 6: Make it harder next time

Turn on automatic updates for plugins you trust, and remove plugins you don't use.
Allow SSH and port 8443 only from your IPs, and use SSH keys.
Use 2FA for CloudPanel and WordPress admins.
Keep off-server backups with a few weeks of history, so you can go back further than the infection.
Ask Google to review the site in Search Console once it's clean, if it was flagged.

If you're not sure whether a file is malicious, post the file name and a few lines (never passwords) in this section and ask.

Sources: WP-CLI: verify-checksums · Google: help for hacked sites

More CloudPanel troubleshooting

Applies to CloudPanel v2 on Ubuntu and Debian, October 2026. Replace

Code:

example.com

with your domain and

Code:

siteuser

with your site's user name.