My website has been hacked: restore the machine from a clean snapshot

The website shows a page that is not yours. Or Google warns that your site "may harm your computer". Or the server is painfully slow and among the processes there is something called kdevtmpfsi eating the CPU. You have been hacked. It is a bad moment, but if you have snapshots, it is sorted in an afternoon and without paying anyone.

The central idea is that you do not clean a compromised machine: you abandon it. You will never know for sure what else they left inside. What you do know is that the snapshot from ten days ago was healthy. So you bring up a new machine from that copy, bring it up to date, close the door they came in through and hand it the website's address. The old one you leave switched off and isolated in case you need to look at what happened.

The guide is written for Lightsail; in EC2 the steps are the same with other menu names.

Step by step

1. Confirm the break-in and do not delete anything

   Usual signs: content or links you did not put there, redirects to other websites, emails from AWS about suspicious activity, Google Search Console warnings, the machine at 100% CPU for no reason, new users in WordPress or in the system, files modified at odd hours.

   And the first thing NOT to do: do not delete files, do not reinstall on top, do not "clean" the server. Two reasons. One, the attacker has probably left more than one door and cleaning by hand does not find them all. Two, if you have insurance, customers with personal data or have to notify the Data Protection Agency, you will want to keep the machine as it is so someone can look at it. Right now, take a snapshot of the compromised machine with a clear name (web-COMPROMETIDA-2026-10-28) and do not touch it again.

2. Isolate the machine by closing the firewall

   Go to Lightsail, click the machine's name and open the Networking tab. In the IPv4 Firewall block you will see the rules: usually SSH (22), HTTP (80) and HTTPS (443). Delete all the rules except SSH and, in the SSH one, click the pencil, tick Restrict to IP address and enter only your current IP (you can see it by searching "what is my IP" on Google). Do the same in IPv6 Firewall if it is enabled.

   With this the website stops being visible, yes. But it also stops serving malware to your visitors, sending spam and attacking third parties from your address. A few hours without a website can be explained; a complaint cannot. For the following steps you do not need to log in to the old machine, so you can remove the SSH rule as well.

3. Choose a snapshot from before the attack

   In the left-hand menu of Lightsail, Snapshots. You will see the list of copies of that machine with their date. You need one that is earlier than the first symptom, with a margin: if you noticed something on the 25th, do not take the one from the 24th, because the attack may have started days before becoming visible. If the website is WordPress, modified files have a date: look at it in the copy or in the file manager, and take a snapshot from at least a week earlier.

   Losing the changes made since that date is unavoidable: orders, posts, photos. Write down which ones they are so you can put them back by hand at the end. If the database is on another machine or in RDS, it is not affected by this step, but check its users and passwords anyway (step 5). If you have no clean snapshot at all, see the problems section: the recovery is different.

4. Create a new machine from the snapshot

   On the chosen snapshot, three-dot menu, Create new instance. Choose the same Availability Zone as the old machine (the static IP can only be moved within the same region), the same plan or a larger one, and give it a new name (web-2026-10-28). Let it boot: it takes a couple of minutes.

   The new machine is born with the default firewall (22, 80 and 443 open to everyone). Before anything else, Networking tab and restrict 22 to your IP, just as you did in step 2. Leave 80 and 443 closed for now: do not publish it until you have updated it.

5. Update and change every password and key

   Log in to the new machine with Lightsail's Connect using SSH button (it opens a terminal in the browser, nothing to install). Now, in order:

   • Update the system: on Ubuntu or Debian, sudo apt update && sudo apt upgrade -y. On Bitnami images, also update the application from its panel.
   • Update the website: WordPress, theme and all plugins. Delete the plugins you do not use. In 90% of cases the door was an outdated plugin.
   • Website passwords: every administrator user. Remove the ones you do not recognise.
   • Database password, and update it in the website's configuration file (wp-config.php or equivalent).
   • SSH key: in Lightsail, Account menu, SSH keys, create a new one and delete the old one; on the machine, replace the contents of ~/.ssh/authorized_keys. The old key may have left the compromised machine.
   • External service keys that were on the machine: email (SMTP), payment gateway, AWS API if there was one. Generate new ones and revoke the previous ones.

   Also look at /etc/passwd and root's crontab in case the snapshot was not as clean as you thought: users you do not know or strange scheduled tasks. If you see something, go back to step 3 with an older snapshot.

6. Move the static IP and check the DNS

   In Lightsail, Networking menu (the left-hand one, not the machine's tab). Click the website's static IP: you will see which instance it is attached to. Detach it from the old machine and attach it to the new one. The change is immediate and the domain keeps pointing to the same address, so there is no need to wait for the DNS to propagate.

   Even so, go to your domain provider (or DNS zones in Lightsail if you manage it there) and go over every record. Attackers sometimes do not touch the server, but they do add records that divert email or a subdomain. If you see an A, MX or TXT record you do not recognise, delete it.

   Now yes: on the new machine, Networking tab, add the HTTP (80) and HTTPS (443) rules open to everyone. Check the website from your phone on mobile data, which does not go through your network, and look at the HTTPS certificate's expiry date: it is in the snapshot and should renew on its own.

7. Afterwards: close the door and do not come back here

   The old machine: leave it stopped for a month, with the firewall closed. In Lightsail it is still charged while stopped, so if the cost matters, delete it and keep the snapshot from step 1, which holds the evidence. After a prudent time, delete that snapshot too.

   And three measures so it does not happen again:

   • Automatic snapshots: on the new machine, Snapshots tab, turn on automatic ones (Lightsail keeps the last seven, one a day). To keep some for longer, take a manual one each month.
   • Updates: once a week, system and website. Set a reminder. It is boring and it is what prevents 90% of break-ins.
   • Port 22 only to your IP, and closed when you are not using it. There is a guide in this section just about that. And if the website does not need anyone uploading files over FTP, do not keep 21 open.

   Finally, if the website stored customer data, check with whoever handles data protection at your company: a server break-in may require notifying it within 72 hours.

What can go wrong