Secure the relevant administrator credentials, including website application accounts. If hosting credentials may have been exposed, change them as well.
Record what you observed, including unexpected pages, redirects, files, administrator accounts, emails or error messages and the approximate time you first noticed them.
Keep an appropriate copy or backup for investigation where possible. Immediately deleting every suspicious file can remove evidence and can also damage the website.
Check whether the website software, themes, plugins and extensions are current and remove components that are no longer required.
Do not assume that changing a domain's DNS or nameservers removes malicious code from the hosting account.
Open a Kimnet support ticket with the affected domain and a clear description of the symptoms. Do not include passwords in the ticket.
Website cleanup can require application-level investigation beyond basic hosting availability. The appropriate response depends on how the website was built and what was affected.
Was this article helpful?