> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Linux Server Hacked? What to Do Step by Step

> Linux server hacked? Cut off the attacker, keep evidence, check logins, users, SSH keys, cron jobs and processes, then rebuild and restore clean backups.

If your Linux server is hacked, act in this order: cut the attacker off (block access and change passwords from a different, clean computer), keep evidence such as logs and a snapshot, find out how they got in by checking logins, users, SSH keys, cron jobs and running processes, then rebuild the server from a clean image and restore only data you know is clean. Cleaning a hacked server in place is rarely reliable.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Intermediate | 1–4 hours | Ubuntu, Debian, AlmaLinux, Rocky Linux and other distributions | Root access, a clean computer, VNC console access |

## Before you start

* Work from a computer you trust. If your own PC may be infected, use another device to change passwords.
* Do not delete suspicious files yet. You need them to find out what happened.
* Have access to the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) and [rescue mode](https://help.freakhosting.com/portals/vps-panel/how-to-use-rescue-mode.md) on a VPS. On a dedicated server, [open a ticket](https://freakhosting.com/clientarea/submitticket.php) if you need console access or a reinstall.

## What are the signs that a Linux server is hacked?

* Logins you do not recognise in `last` or the SSH log.
* New users, new SSH keys in `authorized_keys`, or new sudo rights.
* High CPU from an unknown process (often a cryptocurrency miner).
* Unknown cron jobs or systemd services.
* Outgoing spam or attack traffic, or an abuse report about your IP address.
* Changed website files, unknown PHP files in upload folders, or redirects to other sites.

## Step 1: Cut off the attacker

**1. Take a snapshot or backup first**

A snapshot keeps the evidence before you change anything. See [schedule and restore backups](https://help.freakhosting.com/portals/vps-panel/how-to-schedule-and-restore-backups.md). Label it clearly as compromised so you never restore it by mistake.

**2. Limit network access**

Allow SSH only from your own IP address, using the VNC console if needed:

> [tab] Ubuntu / Debian (UFW)
>
> `ufw reset` removes all existing rules, including ones that allow SSH from anywhere. Run this from the VNC console:
>
> ```bash theme={null}
> sudo ufw reset
> sudo ufw default deny incoming
> sudo ufw allow from 203.0.113.10 to any port 22 proto tcp
> sudo ufw enable
> ```

> [tab] AlmaLinux / Rocky (firewalld)
>
> ```bash theme={null}
> sudo firewall-cmd --permanent --zone=trusted --add-source=203.0.113.10
> sudo firewall-cmd --permanent --remove-service=ssh
> sudo firewall-cmd --reload
> ```

Replace `203.0.113.10` with your own public IP address. You can also restrict traffic in the [firewall panel](https://help.freakhosting.com/portals/firewall/firewall-panel-overview.md).

**3. Change every credential**

From a clean computer, change the root password, every user password, your client area and panel passwords, and database, email and API passwords stored on the server. Create a new SSH key pair; the old private key may be stolen.

> [!WARNING]
>
> Removing SSH access for everyone except your IP can lock you out if your IP changes. Keep the VNC console open while you make these changes.

## Step 2: Find out how they got in

Run these checks and write down anything you did not create.

### Who logged in and when?

```bash theme={null}
last -i -n 50
sudo journalctl -u ssh --since "30 days ago" | grep "Accepted"
```

Use `-u sshd` on AlmaLinux/Rocky. See [check login history](https://help.freakhosting.com/portals/other/how-to-check-who-is-logged-in-and-login-history.md).

### Which users and keys exist?

```bash theme={null}
awk -F: '$3 == 0 || $3 >= 1000 {print $1, $3, $7}' /etc/passwd
getent group sudo wheel
sudo find / -name authorized_keys -path "*/.ssh/*" 2>/dev/null -exec ls -la {} \;
```

`nobody` (UID 65534) is a normal system account. Any other user with UID `0` besides `root`, or a key you did not add, is a backdoor.

### What runs on a schedule or at boot?

```bash theme={null}
sudo ls -la /etc/cron.* /var/spool/cron/ /var/spool/cron/crontabs/ 2>/dev/null
for u in $(cut -d: -f1 /etc/passwd); do sudo crontab -l -u "$u" 2>/dev/null | sed "s/^/$u: /"; done
systemctl list-unit-files --state=enabled --type=service
sudo ls -lt /etc/systemd/system/ | head -20
```

### What is running and listening?

```bash theme={null}
ps auxf --sort=-%cpu | head -20
sudo ss -tulpn
sudo ss -tnp state established
```

Look for processes with odd names, processes running from `/tmp`, `/dev/shm` or `/var/tmp`, and connections to unknown addresses.

### Which files changed recently?

```bash theme={null}
sudo find /etc /usr/bin /usr/sbin /var/www /tmp /dev/shm -type f -mtime -7 -ls 2>/dev/null | head -50
```

On Ubuntu and Debian, `sudo apt install debsums` and `sudo debsums -c` list package files whose contents changed. On AlmaLinux/Rocky, `sudo rpm -Va` does the same.

Then run a [malware and rootkit scan](https://help.freakhosting.com/portals/other/how-to-scan-a-linux-server-for-malware.md). Common ways in are a weak or reused password, an outdated web application or plugin (for example WordPress), an exposed database or admin panel, and a stolen SSH key.

## Step 3: Rebuild and restore

**1. Copy off the data you need**

Copy website files, databases and configuration to a safe place. Treat them as untrusted: check them before you restore.

**2. Reinstall the operating system**

Use a current, supported release. On a VPS, see [rebuild and reinstall your VPS](https://help.freakhosting.com/portals/vps-panel/how-to-rebuild-and-reinstall-your-vps.md). On a dedicated server, [open a ticket](https://freakhosting.com/clientarea/submitticket.php).

**3. Harden before you go live**

Work through the [Linux server hardening checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md): updates, a sudo user, SSH keys only, a firewall and Fail2Ban or CrowdSec.

**4. Restore clean data only**

Restore from a backup made before the break-in. Update every application to its latest version, and reinstall plugins and themes from their official source instead of copying them.

**5. Fix the way in**

Close the hole you found in Step 2. If you could not find it, assume it was a stolen password or an outdated application, and change both.

## Can I clean a hacked server without reinstalling?

Only if you are certain what the attacker changed, for example one infected upload in a website with no root access gained. Once an attacker has had root, they can hide tools that scanners miss, so a reinstall is the only way to be sure.

## Frequently asked questions

### How did my server get hacked if I use strong passwords?

Many break-ins use an outdated web application, a plugin with a known flaw, or a key or password stolen from another machine. Check web server logs as well as SSH logs.

### Should I report the attack?

If your server attacked others or sent spam, answer any abuse report you receive with what you found and what you fixed. If personal data was exposed, check your legal duties to report it.

### My server is mining cryptocurrency. Is killing the process enough?

No. Miners usually come back through a cron job, a systemd service or a backdoor. Follow all three steps.

### How do I prevent this next time?

Turn on [automatic security updates](https://help.freakhosting.com/portals/other/how-to-enable-automatic-security-updates.md), use SSH keys only, keep off-server [backups](https://help.freakhosting.com/portals/other/how-to-back-up-a-linux-server.md), and review logins regularly.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Scan for malware](https://help.freakhosting.com/portals/other/how-to-scan-a-linux-server-for-malware.md)
>
> ClamAV and rkhunter.

> [card] [Check login history](https://help.freakhosting.com/portals/other/how-to-check-who-is-logged-in-and-login-history.md)
>
> Find unknown logins.

> [card] [Security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md)
>
> Harden the new server.

> [card] [Back up a Linux server](https://help.freakhosting.com/portals/other/how-to-back-up-a-linux-server.md)
>
> Be ready next time.

> [card] [Rescue mode](https://help.freakhosting.com/portals/vps-panel/how-to-use-rescue-mode.md)
>
> Access your disk safely.

***

> [!NOTE]
>
> **Checked against the official manuals for OpenSSH, util-linux, procps, iproute2, debsums and rpm, and the [Ubuntu Server firewall documentation](https://ubuntu.com/server/docs/how-to/security/firewalls/)** on 4 November 2026; the inspection commands were tested on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.