My blog got hacked last week.
I should’ve known something was up when after clicking on a blog comment notification in my email I landed on a page that declared me a Google winner.
Instead of realizing that I got hacked, I blinked a few times, closed the page (I was on my phone), came back to my email and clicked again. This time around, I got where I was going to — the dashboard.
I fired up my computer and went directly to my blog. All good. I went to my email and clicked on the same comment link, then other links. No surprises there. I scratched my head thinking I must’ve “misclicked” on some rogue link that got me to the scam page, and decided to stop thinking more because that had already been a bit too much brain activity. I just logged out and mentally closed the case.
Next morning I was checking my email. I always do that before fully waking. I find it helps me focus and start my day on the right note. 🙂
And focus it did. See, this is a report I normally get in my email from my hosting company’s daily scans.
But that morning something was off.
And when I clicked through, the message got abundantly clear.
I don’t know about you, but …
Malware is not my thing. So not my thing that I’ve never felt compelled to learn anything about it beyond installing some software just in case. I’ve run my blog for 8 years, and even found sad refuge in the fact that it’s so tiny that no one would want to mess with it.
So I splashed some cold water on my face and began the hard task of educating myself on the subject matter. How bad is it when your site gets hacked?
Holy s*it, it was bad!
I found that not only can you lose your own reputation, but you can also get shut down by your hosting provider and, oh the humanity, blacklisted by Google itself!
Turns out not only did I need to fix it, but fix it quick.
But I only saw the hack once – why?
To be honest, the more I educated myself – the more I was floored by the inventiveness and sophistication of the scammers. I’ve learned they may not even show you, the administrator, what they’ve been doing to your site. The only reason I saw it for the first time was probably because I logged on to my account from my phone. I don’t often do that so the scammers may not have known I was the admin. During my subsequent visits they probably knew who I was already.
SiteGround, my hosting provider, is using Sucuri for their scans and it recommended its services for cleaning and safeguarding my blog. I went to Sucuri and quickly found out that their cheapest plan was $199 per year.
Now, $199 is not an incredible sum of money, but, well, it kind of is for a blog that doesn’t bring in a single penny. Which is why a lot of thoughts were racing around my head.
I had almost quit blogging a few months ago—
Because it wasn’t going anywhere anyway—
And now that I was already paying for hosting and the domain and even some other stuff I didn’t even understand …
I had to pay $200 more …
All that just for the privilege of running my mouth on a computer screen when I felt like it?
Naturally, being a cheap bastard, I did try to find another way
Jumping ahead, I didn’t find it. But between trying and failing I made a few discoveries.
If you consider starting your own blog, you might want to learn some “technicalities.” You can fix that menace yourself, at least in some milder cases.
Sucuri, it seems, is quite honest about the fact that you can get rid of malware yourself. And it even tells you how.
1.1 – Scan Your Site
OK, that I can do. Well, I mean having others do it including Sucuri.
1.2 – Check Core File Integrity
Uhm … huh?
1.3 – Check Recently Modified Files
1.4 – Check Diagnostic Pages
But that was nothing compared to what you (I) would have to do next. After identifying the threats, you’re supposed to remove them. Manually!
2.1 – Clean Hacked Website Files (8 steps)
2.2 – Clean Hacked Database Tables (7 steps)
2.3 – Secure User Accounts
2.4 – Remove Hidden Backdoors
2.5 – Remove Malware Warnings
OK, that was enough for me, and I didn’t even bother getting to Step 3 – Securing Your Website from Hackers.
I checked some other Malware protection services
Some of them were a little cheaper, but they also seemed kind of shadier. So with a heavy heart, I went ahead and paid $199 just to be done with it. Hey, at least I’ll get $10 back from PayPal (Discover 3rd quarter PayPal bonus).
My site was cleaned within minutes even though I’d read a few reviews that Sucuri could be slow. I had some questions initially, but they were quickly and courteously resolved via chat. No complaints so far.
You can’t get your money back after you submit the removal request
Other than that, the only thing I wish is that they offered a more affordable plan for small bloggers like me, but oh well.
Should you pay for malware protection and (potential) removal services?
If your website is not a moneymaker, I’m not convinced. Like I said, I’ve run my blog for 8 years, and never had a problem like this before. But it’s important to react quickly, and there are free plug-ins including Sucuri if your hosting provider doesn’t offer a malware scanning service.
If your site does get hacked, you can quickly sign up for a security service and get it cleaned. Better yet, try to learn a few tricks so you can do it yourself. Now, for a commercial website, the math is completely different, and one would be foolish not to protect themselves the best they can.
A couple of questions for my readers:
- Did anyone notice anything weird on my blog last week?
- Anyone else have gotten hacked? How do you deal with it?