Hacked Website Recovery & Secure AWS Migration for a News Portal

The challenge: a hacked website and an expiring SSL certificate

The client suspected their website had been hacked. Visitors were loading scripts the client had never added, and the site ran on an ageing, unmanaged server with no clear owner.

They needed answers quickly:

• Was the site really hacked, and how did the attackers get in?
• Could 27,000+ articles be saved without carrying the infection forward?
• Could the site move to a safe, maintained home before its SSL certificate expired a few days later?

Website security audit: what we found

We started with a read-only security audit and changed nothing on the live server, so the evidence stayed intact. We took a full, verified backup first.

• Malicious JavaScript in almost every article. Attackers had injected third-party script tags into nearly all ~27,000 articles. Every reader was loading code from attacker-controlled domains.
• Hidden SEO spam and a backdoor. We found invisible gambling-link spam and a dormant backdoor file left behind for re-entry.
• Web shells disguised as images. Attackers had uploaded server-side scripts through image upload fields that accepted any file type. The earliest traces went back several years.
• Brute-forced admin login. The login allowed unlimited password guesses, and logs showed a successful attack.
• SQL injection flaws. Several public pages built database queries directly from visitor input.

Malware removal and secure recovery

• Cleaned the database with repeatable, audited scripts that removed every injected script, the spam and the web-shell references.
• Verified all ~33,000 images against checksums before moving them. No file touched the new site until it passed type and content checks.
• Recovered 249 article images that had been missing for years from public web archives. Each one was scanned for hidden code before use.

Closing the security holes (PHP, Yii, MySQL)

• Locked down admin-only pages and fixed SQL injection flaws throughout the code.
• Restricted uploads to real image types, and made sure uploaded files can never run as code.
• Added automatic blocking of repeated failed logins (brute-force protection).
• Removed the backdoor, debug tools and outdated third-party scripts.
• Gave the application a least-privilege database account and kept all passwords out of the code.

Secure migration to AWS

• Built a new Ubuntu server on AWS (London) with key-only SSH, a firewall and intrusion blocking.
• Set up automatic security updates, nightly database backups and daily server snapshots.
• Put free, auto-renewing HTTPS (Let's Encrypt) in place before the DNS switch, so returning visitors saw no certificate warnings.
• Tested everything on a private staging address, with the client reviewing the content, before switching the live domain.

Managed hosting and website maintenance

The client now has a single monthly plan covering hosting, security monitoring, backups and maintenance, with a roadmap to modernise the platform.

Results

We didn't just remove the malware. We found out how it got in, closed every door, and moved the site somewhere it can be looked after properly.

Technologies used

• PHP
• Yii framework
• MySQL
• Apache
• Ubuntu 24.04
• AWS Lightsail
• Let's Encrypt
• fail2ban
• UFW

My website got hacked. What should I do?

If your website has been hacked, or you think it might have been, these are the first steps we recommend. They are the same steps we followed in this project.

1. Don't delete anything yet. Deleting infected files straight away destroys the evidence of how the attackers got in, and they will come back the same way.
2. Take a full backup now. Copy all website files and the database, even though they are infected, so no content is lost during the clean-up.
3. Change every password from a clean device. Hosting control panel, FTP/SFTP, database, website admin accounts and the email linked to them. Remove any admin users you don't recognise.
4. Check what visitors and Google see. Look for unfamiliar scripts, redirects or spam pages, and check the Security Issues report in Google Search Console and Google Safe Browsing for warnings.
5. Find the way in. Common entry points are weak or brute-forced logins, outdated software or plugins, upload forms that accept any file, and SQL injection. Removing malware without closing the hole means the site gets re-infected.
6. Clean or rebuild, then harden. Remove the malicious code, or restore a backup you know is clean, patch the entry point, update everything, and set up backups and monitoring.
7. Ask Google to re-check your site. If your site was flagged, request a review in Search Console once it is clean so the warnings are removed.

Need help now? Luure.ai starts with a read-only security audit that confirms the hack without changing anything, then removes the malware, closes the entry points and moves your site to secure, managed hosting if needed. We help businesses in Kochi, Thrissur and across Kerala, and throughout India.

My website got hacked: get help

Frequently asked questions

How do I know if my website has been hacked?

Common signs are unfamiliar scripts or links in your pages, redirects to other sites, browser or Google warnings, unknown admin accounts and unexpected files on the server. A read-only security audit confirms it without changing anything.

Can a hacked website be cleaned without losing content?

Yes. In this project we kept all 27,000+ articles and removed only the malicious code. We even recovered 249 images that had been missing for years.

Isn't deleting the malware enough?

No. If the way in stays open, attackers come back. We find the entry points, such as weak logins, unsafe uploads or SQL injection, and close them before relaunching.

Do you migrate websites to AWS?

Yes. We build a hardened AWS server, test the site on a staging address and switch the domain with HTTPS ready in advance, so visitors see no downtime or certificate errors.

Do you offer ongoing website maintenance?

Yes. Our managed hosting plans cover the server, security updates, backups and monitoring for one monthly fee.

Do you help businesses in Kerala with hacked websites?

Yes. We are based at Infopark Thrissur and provide website security audits, hacked website recovery, AWS migration and managed hosting for businesses in Kochi, Thrissur and across Kerala, as well as the rest of India.