我的网站被黑掉了——怎么办？
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
2008年4月29日星期二
许多网站管理员都有过这样的遭遇：尽管您绞尽脑汁防止此类事情发生，您的网站还是被黑掉了。一些防患于未然的措施包括确保您的网站及时更新最新的软件和补丁，在
谷歌网站管理员工具
里建立账号以便查看当前被收录的页面，密切注视您的日志文件，确保其中没有可疑的内容等等。（在我们去年发布的
"
网站安全快速检查清单
"
里您可以查看到更加详细的信息。）
请记住，您决不是唯一的受害者——网站被黑的情况变得越来越常见。网站被黑会导致您的站点感染有害软件（更具体地说就是恶意软件，这是有害软件的一种类型）。您可以阅读一下
StopBadware
最近发布的
2007
年有害软件趋势报告
，这篇报告全面分析和总结了近几年来不良软件的发展趋势及其危害。您还可以看看这篇发表在
谷歌在线安全博客
上的
文章
，它指出，越来越多的搜索结果中包含着被标为对用户计算机有害的
URL
。如果您希望阅读有关基于
Web
的恶意软件的深度分析报告，请您通过下载阅读《
浏览器里的幽灵
》(
pdf
) 和这篇
技术报告
(
pdf
) 。读完这些报告后，您会对这些问题的影响范围有更好的理解。这些报告还包括了一些不同类型恶意软件的真实案例。
在任何情况下，你应该采取的第一步措施都是联系您的主机托管供应商——如果您有的话。多数情况下他们都会为您解决很多技术上的麻烦。许多站长使用共享主机托管，但这样可能会使得下面我们提到的一些措施难以实施。在如下这些措施当中，标注星号（
*
）的就是在使用共享主机托管的情况下，您最有可能需要您的主机托管供应商协助的项目。如果您对所使用的服务器有全部的控制权，我们建议采取下面四个基本步骤：
让您的站点处于离线状态
-
暂时让您的站点处于离线状态，至少等到您确信已经修复了故障为止。
*
-
如果你无法让站点处于离线状态，那么您要返回一个
503
状态代码
，防止搜索引擎抓取到您的网站。
-
在网站管理员工具中，使用
URL
清除工具
，从搜索结果中清除任何已经被搜索引擎收录但之后又被黑掉的页面或
URL
。这样做的目的是防止被黑掉的页面再被用户访问到。
损失评估
-
弄清楚黑客究竟想要干什么是一个聪明的主意。
-
他们是在寻找敏感信息吗？
-
他们是否图谋控制您的站点，用于其他目的？
-
寻找黑客在您的服务器上做过改动或上传的恶意文件。
-
检查您的服务器日志，看看有没有任何可疑的活动，例如失败的登录尝试、命令历史记录（特别是在根目录上）、未知用户账号等。
-
确定问题范围——您是否还有其他站点也受到了影响？
恢复
-
最正确的办法就是采用来源可信的软件，彻底重装一次操作系统。这是唯一可以确保清除一切黑客对您网站造成的影响的方法。
*
-
重新安装后，使用您最近的一次备份，恢复网站内容。别忘了确认一下备份文件绝对安全、没有被黑掉了的内容。
*
-
对所有软件包打补丁，确保它们是最新版，包括
Web
日志平台、内容管理系统，或者其他任何已安装的第三方软件。
-
更改您的密码——
https://www.google.com/accounts/PasswordHelp
重建您的在线系统
-
使您的系统恢复到在线状态
。
-
如果您是网站管理员工具的用户，请登录您的账户
-
如果您的站点被标为含有恶意软件，请您发出评估申请以确定您的站点是否已经安全无毒。
-
如果您使用了
URL
清除工具清除了那些您确实希望搜索引擎收录的
URL
，您可以请求网站管理员工具通过撤销先前的清除操作来使您的内容重新收录。
-
时刻保持警惕，因为黑客或许会卷土重来。
对于您可能提出的其他问题，我们有以下解答：
问：使我的站点处于离线状态，或使用
robots.txt
防止它被搜索引擎抓取到，哪一种做法更好呢？
答：使站点处于离线状态是更好的做法；这样能够防止任何恶意软件或有害软件乘机进入用户系统，并防止黑客进一步滥用您的系统。
问：当我修复了我的站点之后，什么方法可以在最短时间内让我的站点被重新抓取和收录？
答：无论您的站点是否被黑过，最好的方法都是遵从
网站管理员支持中心指南
。
问：我已经对网站进行了清理工作，但是如果黑客在我的网站上放置了指向不良网站的链接，谷歌会对我进行处罚么？
答：我们尽量不这么做。我们能很好地确保良好的站点不会因为黑客和网络垃圾制造者的行为而遭受惩罚。为了安全起见，请彻底清除黑客可能已经放置在您网站上的的任何链接。
问：如果这一切发生在我自家的电脑上怎么办？
答：上述措施依然有效，但是您在清理过程中必须加倍小心；否则的话，同样的灾难还是可能再度发生。最理想的方法是彻底重装操作系统。
其他可能会对您有所帮助的资源：
如果您有一些其它好的建议，欢迎您在本文后留言。
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2008-04-01。
[null,null,["最后更新时间 (UTC)：2008-04-01。"],[[["\u003cp\u003eWebsites can be hacked despite preventative measures, resulting in malware infection and potential badware issues.\u003c/p\u003e\n"],["\u003cp\u003eWebmasters should contact their hosting provider for support and consider taking the site offline or returning a 503 status code.\u003c/p\u003e\n"],["\u003cp\u003eA complete OS reinstall from a trusted source is the best way to ensure complete malware removal, followed by restoring from a clean backup.\u003c/p\u003e\n"],["\u003cp\u003eWebmasters should change all passwords, patch software, and request a review in Google Webmaster Tools if the site was flagged for malware.\u003c/p\u003e\n"],["\u003cp\u003eGoogle tries to avoid penalizing sites for hacker-introduced backlinks, but webmasters should remove any suspicious links to be safe.\u003c/p\u003e\n"]]],["If hacked, immediately contact your hosting provider. Take the site offline or use a `503` status code, and remove hacked URLs via Webmaster Tools. Assess the damage by checking for modified files and suspicious server activity. Recover by reinstalling the OS, restoring from a clean backup, and updating all software. Restore your online presence and request a review in Webmaster Tools. Reinstalling the OS and using updated software are ideal to fully remove any potential harm.\n"],null,["# My site's been hacked - now what?\n\nMonday, April 07, 2008\n\n\nAll right, you got hacked. It happens to many webmasters, even despite the hard work you devote\nto prevent this type of thing from happening. Prevention tips include keeping your site updated\nwith the latest software and patches, creating an account with\n[Google Webmaster Tools](https://search.google.com/search-console)\nto see what's being indexed, keeping tabs on your log files to make sure nothing fishy's going\non, etc. (There's more information in the\n[Quick Security Checklist](/search/blog/2007/09/quick-security-checklist-for-webmasters)\nwe posted last year.)\n\n\nRemember that you're not alone---hacked sites are becoming increasingly common. Getting hacked\ncan result in your site being infected with badware (more specifically malware, one type of\nbadware). Take a look at\n[StopBadware's](https://www.stopbadware.org/) recently released report on\n[Trends in Badware 2007](https://www.stopbadware.org/pdfs/trends_in_badware_2007.pdf)\nfor a comprehensive analysis of threats and trends over the previous year. Check out\n[this light technical report](https://googleonlinesecurity.blogspot.com/2008/02/all-your-iframe-are-point-to-us.html)\non the\n[Google Online Security Blog](https://googleonlinesecurity.blogspot.com/)\nwhich highlights the increasing number of search results containing a URL labeled as harmful. For\neven more in-depth technical reports on the analysis of web-based malware, see\n[The Ghost in the Browser](https://www.usenix.org/events/hotbots07/tech/full_papers/provos/provos.pdf)\n(pdf) and this\n[technical report](https://research.google.com/archive/provos-2008a.pdf)\n(pdf) on drive-by downloads. Read these, and you'll have a much better understanding of the scope\nof the problem. They also include some real examples for different types of malware.\n\n\nThe first step in any case should be to contact your hosting provider, if you have one. Often\ntimes they can handle most of the technical heavy lifting for you. Lots of webmasters use shared\nhosting, which can make it difficult to do some of the things listed below. Certain tips labeled\nwith an asterisk (\\*) are cases in which webmasters using shared hosting will most likely require\nassistance from their hosting provider. In the case that you do have full control over your\nserver, we recommend covering these four bases:\n\nGetting your site off-line\n--------------------------\n\n- Take your site off-line temporarily, at least until you know you've fixed things.\n- If you can't take it off-line, return a [`503` status code](/search/docs/crawling-indexing/http-network-errors) to prevent it from being crawled.\n- In the Webmaster Tools, use the [URL removal tool](https://www.google.com/support/webmasters/bin/answer.py?answer=61062&topic=8459) to remove any hacked pages or URLs from search results that may have been added. This will prevent the hacked pages from being served to users.\n\nDamage Assessment\n-----------------\n\n- It's a good idea to figure out exactly what the hacker was after.\n - Were they looking for sensitive information?\n - Did they want to gain control of your site for other purposes?\n- Look for any modified or uploaded files on your web server.\n- Check your server logs for any suspicious activity, such as failed login attempts, command history (especially as root), unknown user accounts, etc.\n- Determine the scope of the problem---do you have other sites that may be affected?\n\nRecovery\n--------\n\n- The absolute best thing to do here is a complete reinstall of the OS from a trusted source. It's the only way to be completely sure you've removed everything the hacker may have done.\\*\n- After a fresh re-installation, use the latest backup you have to restore your site. Don't forget to make sure the backup is clean and doesn't have any hacked content.\\*\n- Patch any software packages to the latest version. This includes things such as weblog platforms, content management systems, or any other type of third-party software installed.\n- Change your passwords--- [see our help center for tips about creating a strong password](https://www.google.com/accounts/PasswordHelp)\n\nRestoring your online presence\n------------------------------\n\n- Get your system back online.\n- If you're a Webmaster Tools user, sign in to your account\n - If your site was flagged as having malware, request a review to determine whether your site is clean\n - If you used the URL removal tool on URLs which you do want in the index, request that Webmaster Tools re-include your content by revoking the removal.\n- Keep an eye on things, as the hacker may try to return.\n\nAnswers to other questions you may be asking:\n\n\n**Is it better to take my site off-line or use robots.txt to prevent it from being crawled?**\nTaking it off-line is a better way to go; this prevents any malware or badware from being served\nto users, and prevents hackers from further abusing the system.\n\n\n**Once I've fixed my site, what's the fastest way to get re-crawled?** The best way, regardless\nof whether or not your site got hacked, is to follow the\n[Webmaster Help Center guidelines](/search/docs/fundamentals/get-on-google).\n\n\n**I've cleaned it up, but will Google penalize me if the hacker linked to any bad\nneighborhoods?** We'll try not to. We're pretty good at making sure good sites don't get\npenalized by actions of hackers and spammers. To be safe, completely remove any links the hackers\nmay have added.\n\n\n**What if this happened on my home machine?** All of the above still applies. You'll want to\ntake extra care to clean it up; if you don't, it's likely the same thing will happen again. A\ncomplete re-install of the OS is ideal.\n\nAdditional resources you may find helpful:\n\n- If your site's been flagged by Google as serving malware, we'll [alert you](/search/blog/2006/11/badware-alerts-for-your-sites) when you visit [Webmaster Tools](https://search.google.com/search-console).\n- Don't forget about the [Google Webmaster Help Group](https://support.google.com/webmasters/community); it's full of extremely knowledgeable users, and Googlers as well. For a nice, on-topic example, check out [this thread](https://groups.google.com/group/Google_Webmaster_Help-Indexing/browse_thread/thread/98cd67810dc69942/72809bf28e8e039a). There's also a [Stop Badware group](https://groups.google.com/group/stopbadware).\n- Matt Cutts recently posted [Three tips to protect your WordPress installation](https://www.mattcutts.com/blog/three-tips-to-protect-your-wordpress-installation/) on his blog, and there are lots of great comments below the post as well.\n\nWritten by Nathan Johns, Search Quality Team"]]
