> ## Content Index
> Fetch the complete content index at: https://imknight.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How does a server beginner recover a compromised site
- URL: https://imknight.com/how-does-a-server-beginner-recover-a-compromised-site/
- Published: 2019-10-13T14:34:30.000Z
- Updated: 2019-10-13T14:35:04.000Z
- Description: I consider myself a beginner on managing server, I have some Linux knowledge, I understand some of the necessary command line code, and I know how to Google for some command to help me manage my server.
- Author: knight
- Tags: Mix, #Import 2026-06-10 02:20

I consider myself a beginner on managing server, I have some Linux knowledge, I understand some of the necessary command line code, and I know how to Google for some command to help me manage my server. I m a total newbie in server management.

My usual combo to set up a site are using Laravel Forge + Linode VPS, make use of the auto deployment and GUI, nothing much issue for maintaining the hosting.  
One of my biggest fear happens before I went on a short trip last month. I am getting an email from Linode because one of my VPS has been compromised and sending out spam. Since every site in that VPS is using Git versioning control, I find out one of the sites has been injected some additional PHP script pretty fast. I think the hacker uploads these script through an outdated theme that I no longer in use. I backup the hacked site, planning to check it in future, remove the theme and restore the site to the previous version.

I thought I solved it, but I m wrong. The spam still keeps generated, and I can only disable the Sendmail service to avoid sending out any spam. After coming back from the trip and I m keep thinking how to solve this issue. Without much server knowledge, I don't know how to find out what causes this.  
I decided to migrate to a new server after listening to the same recommendation from Linode support as well. After relocating to the new server, it still keeps generate spam and sending out; I disabled the Sendmail service on the new server again.  
One of my server friends tell me to check the server process, monitor the ports, but I think the issue is not on the server. Most likely there are still some script somewhere that generate the spam.

I clear all the spam and start monitoring the mail queue, once the spam appears, I note down the time and trying to search for relevant logs. Finally, I find through the server logs there are some external calling for a PHP script within my upload folders. That's the reason why my server keeps generate spam. I didn't commit the upload folder to my git repo, which is why I didn't discover these scripts.

After removed these scripts, my server has been spam-free for the past 24 hours.