How do I recover a hacked or compromised server?

Discovering your server has been hacked is alarming, but acting quickly and methodically limits the damage and gets you back to a clean state. Follow these steps in order to lock things down and recover safely.

First priority: contain it

The moment you suspect a compromise, the goal is to stop further access and then rebuild from something you trust.

Step-by-step

1. Stop the server immediately to cut off any active intrusion.
2. Rotate your credentials. Change your panel password and any admin/RCON passwords, and rotate op/permissions.
3. Restore a clean copy of your files from before the compromise — open your server → Backups and restore a backup from before it happened (or use your own copy).
4. Update and clean up. Update plugins/mods and remove anything you didn't install yourself.

Tip: If you're unsure what's safe to keep, open a ticket with the details and we'll help you check.

Frequently asked questions

How do I know which files were tampered with? Look for plugins, mods, or scripts you don't recognize, and check recent changes in the Files manager. When in doubt, restoring a known-clean copy is safer than trying to clean in place.

I don't have a clean backup — what now? Check your server's Backups page first — every server is backed up automatically twice a day, so there's usually one from before the compromise. If none is clean, open a ticket and we'll help you assess what's on the server and work out the safest path forward.