How to Fix a Hacked Drupal Site (Step-by-Step) in 2026

A hacked Drupal site is a serious issue that can compromise user data, damage your reputation, and lead to search engine penalties. Drupal is known for its strong security, but misconfigurations, outdated modules, or server vulnerabilities can still lead to breaches.

This step-by-step guide will help you fully clean, recover, and secure your Drupal site in 2026.

Step 1: Confirm the Hack

Before taking action, verify that your site has actually been compromised.

Common signs of a hacked Drupal site:

• Unexpected redirects to spam or malicious domains
• Unauthorized admin accounts or role changes
• Modified or deleted content
• Suspicious JavaScript injected into pages
• Hosting provider suspension or warning
• Google flagging your site as unsafe
• Sudden traffic drops or SEO ranking loss

Initial checks:

• Visit your site in incognito mode
• Check your hosting dashboard for alerts
• Review logs (access logs, error logs)
• Look at Drupal’s Recent Log Messages (/admin/reports/dblog)

If anything looks suspicious, proceed immediately.

Step 2: Take the Site Offline

Prevent further damage and protect visitors.

Actions:

• Enable maintenance mode (/admin/config/development/maintenance)
• Restrict access via .htaccess or server config if needed
• Notify your hosting provider
• Inform your internal team

This stops attackers from continuing activity while you investigate.

Step 3: Reset All Credentials

Assume all credentials are compromised.

Change immediately:

• Drupal admin and user passwords
• Database credentials
• FTP/SFTP/SSH access
• Hosting control panel
• API keys and integrations

Best practices:

• Use strong, unique passwords
• Enable multi-factor authentication (MFA)
• Remove unused accounts

Step 4: Create a Full Backup of the Current State

Even if the site is infected, preserve a copy for analysis.

Backup:

• Entire Drupal file system
• Database dump

Why:

• Compare infected vs clean files
• Investigate entry points
• Preserve evidence if needed

Step 5: Identify the Scope of the Infection

Understanding how deep the hack goes is critical.

Check:

• Core files
• Contributed modules and themes
• Custom code
• Uploaded files (/sites/default/files)
• Database content

Look for:

• Recently modified files
• Unknown PHP scripts
• Obfuscated code (base64, eval, gzinflate)
• Suspicious cron jobs or scheduled tasks

You can use command-line tools or security scanners compatible with Drupal.

Step 6: Put the Site in a Clean State (Critical Step)

Never try to “patch” a hacked Drupal site. Replace everything with clean code.

Recommended approach:

1. Remove all core files

Delete everything except:

• /sites directory
• settings.php
• Uploaded files (temporarily keep for inspection)

2. Download a fresh copy of Drupal core

From the official Drupal source matching your version (or latest secure version).

3. Reinstall core files

Upload clean Drupal core files to your server.

4. Replace all modules and themes

• Delete all existing modules and themes
• Re-download fresh copies from trusted sources
• Avoid using outdated or unsupported modules

5. Review custom code carefully

If you have custom modules/themes:

• Audit them line-by-line
• Remove any suspicious code

Step 7: Clean the Database

Attackers often inject malicious content into the database.

Check:

• Users table (look for unknown admins)
• Content tables (spam pages, hidden links)
• Configuration (config table in Drupal 8+)
• Sessions and cache tables

Actions:

• Delete unauthorized users
• Remove spam content
• Clean injected scripts
• Clear all caches

Step 8: Inspect Uploaded Files

The /sites/default/files directory is a common attack vector.

Look for:

• PHP files (should not normally be there)
• Files with random or suspicious names
• Recently uploaded files you don’t recognize

Action:

• Delete malicious files
• Restrict execution of PHP in uploads directory via server config

Step 9: Check for Backdoors

Hackers often leave hidden access points.

Common backdoor locations:

• /sites/default/files
• /modules or /themes directories
• Root directory

Signs of backdoors:

• Files with names mimicking system files
• Code using dangerous functions (eval, assert, preg_replace /e)
• Hidden admin access scripts

Remove any suspicious files immediately.

Step 10: Update Everything

Outdated software is one of the most common causes of Drupal hacks.

Update:

• Drupal core
• All contributed modules
• Themes
• Server software (PHP, database, etc.)

Use:

• Composer (recommended for Drupal 9/10/11 sites)
• Official Drupal security advisories

Step 11: Fix File Permissions and Server Security

Improper permissions can allow attackers to modify files.

Recommended permissions:

• Files: 644
• Directories: 755
• settings.php: read-only when possible

Additional steps:

• Disable PHP execution in uploads directory
• Secure .htaccess
• Use a Web Application Firewall (WAF)

Step 12: Check for SEO Spam and Blacklisting

If your site was used for spam, clean it up thoroughly.

Actions:

• Remove spam pages and hidden links
• Check search engine indexing (site:yourdomain.com)
• Use Google Search Console to identify issues
• Request a security review after cleanup

Step 13: Determine How the Hack Happened

If you don’t find the root cause, it may happen again.

Common causes:

• Outdated modules/themes
• Weak passwords
• Poor server configuration
• Vulnerable custom code
• Third-party integrations

Investigate:

• Server logs
• Drupal logs
• Login attempts
• File change history

Step 14: Harden Your Drupal Site

Prevention is just as important as cleanup.

Essential security measures:

Enable security modules

Use trusted Drupal security modules for:

• Login protection
• Activity logging
• Intrusion detection

Enforce strong authentication

• Enable MFA for admins
• Limit login attempts

Restrict access

• Limit admin access by IP if possible
• Disable unused modules

Use HTTPS

Ensure SSL is enforced site-wide

Automate backups

• Daily backups recommended
• Store backups offsite

Step 15: Monitor Continuously

Security is ongoing.

Set up:

• File integrity monitoring
• Real-time alerts
• Regular vulnerability scans
• Uptime monitoring

Step 16: When to Seek Professional Help

Consider expert assistance if:

• The infection is widespread
• You’re unsure how to clean files or database safely
• The site stores sensitive user data
• You’ve been repeatedly hacked

Final Checklist Before Going Live

• All core files replaced with clean versions
• Modules and themes reinstalled safely
• Database cleaned
• Unauthorized users removed
• Backdoors eliminated
• Passwords reset
• Security measures implemented
• Site fully updated
• Search engine warnings addressed

Final Thoughts

Fixing a hacked Drupal site requires a thorough and methodical approach. The most important principle is this: never trust existing files—replace them with clean versions and rebuild securely.

Once your site is restored, ongoing monitoring and proactive security practices will ensure you stay protected in 2026 and beyond.