The first hours after a defacement

A defacement is visible, and that is why people rush it the wrong way: they put an old archive on top, are glad "the site is back", and the next morning see the same message. The entry stayed. The archive may already have contained the same door. The first hours exist so you do not cement the outage.

An order without heroics

• Take the page off public access or put up a short holding page. Without deleting files still needed for the review.
• Keep a copy of what is on the server now, and the web server logs. That is evidence, not trash.
• Change panel, CMS and database passwords. Drop sessions.
• Look at other sites and mailboxes in the same account. The defacement is often not the only one.
• Bring up a clean copy only after the entry is understood. Otherwise you publish the same hole.

Customers are better told shortly and in your own words: the site is temporarily closed, and orders and passwords are not being taken on it right now. A long "we were hacked but everything is under control" without facts only breeds screenshots.

Lexora runs these hours as response: contain, find the entry, return a clean version, close the door. In parallel it makes sense to put observation in place, so the next defacement is not discovered by a customer.