We've found a phishing page on your website: what it means and what to do

If you've received a ticket from us saying a phishing page has been found on your website, this article explains what's going on and exactly what to do. Please act on it straight away. The quicker it's removed, the less chance there is of your domain being blacklisted or your hosting being suspended.

What is a phishing page?

A phishing page is a fake login page, usually made to look like Microsoft 365, a bank, a courier or a payment service. Scammers send people a link to it, and anything typed into it (passwords, card details) goes straight to the scammer.

When we receive a report from a security company, a bank or another network about a phishing page on one of our servers, we open a ticket with the website owner. In the ticket we include the reported address with the link deliberately broken (for example hxxps://yourdomain[.]co[.]nz/folder/) so nobody opens it by accident.

Did I do something wrong?

Almost certainly not. In nearly every case, the site owner didn't put the page there. Someone got into the site, usually through:

• an outdated WordPress install, plugin or theme
• an old or forgotten copy of the site, such as an /old or /test folder
• a weak, reused or leaked password for WordPress, cPanel or FTP

Phishing content is still a serious breach of our Acceptable Use Policy, so it has to be dealt with promptly, whoever put it there.

Step 1: Take a backup first, and keep it

Before you delete anything, take a full backup of your account and download it to your computer. The organisation that reported the page, and sometimes the police, may want to investigate, so the fake files need to be kept safely rather than destroyed.

1. Go to Services → My Services (https://www.hooplahosting.co.nz/client/clientarea.php?action=services) and open your hosting service.
2. Under Quick Shortcuts, click Backup and download a full backup. See Download a full backup of your hosting account.

Don't restore this backup later. It contains the malicious files. Label it clearly and keep it somewhere safe.

Step 2: Remove the phishing page

1. From your service page, click File Manager under Quick Shortcuts.
2. Go to the folder named in our ticket and delete it.
3. Look around for anything else that doesn't belong:
   • files or folders changed recently that you don't recognise (sort by Last Modified)
   • unknown .php files, or .zip files that the phishing kit was uploaded in
   • folders that look like WordPress folders but aren't quite right. The real ones are wp-admin, wp-content and wp-includes, all lowercase. A folder called Wp-access or wp-admins is a warning sign.

If you'd rather start again, you can restore your site from a backup made before the phishing page appeared. See Restore files, databases or email from a backup (JetBackup). If the site isn't needed any more, you can simply remove it, after taking the backup in step 1.

Step 3: Close the way in

Removing the page isn't enough on its own. If the gap they used is still open, it will usually come back within days.

1. Update everything: WordPress, every plugin and every theme. You can do this from WP Toolkit in cPanel.
2. Delete what you don't use: inactive plugins and themes, and old copies of the site.
3. Check your WordPress users and delete any administrator you don't recognise.
4. Change your passwords for cPanel (Change Password on your service page), every WordPress admin, any FTP accounts and the website's database user.
5. Turn on two-factor authentication for cPanel and WordPress. See Turn on two-factor authentication for cPanel.

For a fuller clean-up checklist, see My WordPress website has been hacked: what to do.

Step 4: Reply to our ticket

Once it's done, reply to the ticket we sent you so we can check the site and close the report with the organisation that raised it. If you're not sure you've got everything, say so and we'll take a look.

What happens if it isn't removed?

Phishing pages put other customers and our whole network at risk of being blacklisted. If the page isn't removed promptly, we may need to suspend the hosting account until it's dealt with. We'd much rather avoid that, so if you're stuck, or can't get to it straight away, reply to the ticket and let us know.

Need a hand?

We look after the server and its security, and we're happy to help you find the files, restore a backup or check the site afterwards. Cleaning up website code, plugins and themes is the responsibility of the website owner or their developer. If someone else looks after your site, forward our ticket to them.

If your web developer or a security service needs access to clean the site, don't post passwords in a ticket. See How to send sensitive data to our team securely, and to give someone access to your client area, see Give a team member, developer or staff member access to your client area.