So Outside Technology Security CMS
AnQiCMS
Online Demonstration

After a website is attacked, it is necessary to restore the backup, should the vulnerability be patched first or the data be restored first?

📅 2026-11-01 👁️ 0

After a website is hacked, should you patch the vulnerability first or restore the backup data? The order is to patch the vulnerability first and then restore the data. In the case of large-scale exploitation activities of content management systems, the official recommendations are very clear: first, patch all affected platforms and extensions, and then restore the site from a known good backup. The reason is very direct - if you write the copy back when the entrance is still open, the attacker will come in again through the same path, and the restoration action itself will bring the time point with the backdoor back online.

If the order is wrong, you will be hit repeatedly.

A common phenomenon is that the file is written again with the same abnormal script a few days after it is cleared. This kind of repetition is usually not due to incomplete cleaning, but rather the entry is not closed: some extension has not been upgraded to the fixed version, some account password is still in the attacker's hands, or the temporary debugging interface is still open. Prioritizing patching over recovery is to make the restoration a one-time action, rather than the first step in a loop.

The first step is to cut off the entry

Execute in a verifiable order: first, switch the site to read-only or maintenance mode, limit the access source of the background and interface; then confirm the list of affected programs and extensions, and upgrade each to the fixed version; subsequently, rotate the login credentials and administrator passwords, including the reused old passwords. This step produces a change record, indicating which components were added and which accounts were changed, to facilitate later judgment of which backup is clean.

Why verify on a clean copy?

Backup should be selected at a time point before any suspicious modifications, and with a reason. The criteria for availability are three: there were no abnormal files at that time point, no additional administrator accounts, and the task list is consistent with the site description. If unsure, first restore to an isolated environment and run it, check that the pages, forms, and interfaces can work normally before going online, and avoid bringing back the modified templates and scripts.

Points to note when restoring from a backup

The range of recovery is not limited to the database: uploaded files, templates, and generated static products may also contain abnormal content. After recovery, three checks should be made - whether the account and permission groups have been changed, whether the content status is abnormal, and whether there are any residual test scripts or redirects within the site. The status of the documents should also be checked together: drafts, pending release, and content in the recycling bin may be used to hide things, deleted documents can still be recovered in the recycling bin, and these contents should be checked together when disposed of.

Strengthening after recovery

Make a one-time action a routine: backup tasks should be run regularly and recovery drills should be conducted, sensitive word filtering and content review ensure the outlet of the release side, use JWT and other credentials for login and interface side and add human verification to the form, keep interference codes and other anti-crawling measures within the site. The attack surface mostly does not come from sophisticated techniques, but from components that have not been upgraded for a long time and permissions that no one has reviewed.

Common questions

Can you recover first and then supplement it to reduce downtime?It is not recommended, recovery when the entry is not closed is equal to repeated victimization, the downtime window should be compressed from read-only and maintenance mode.

What should be done if there is no可信 time point?First, do the cleaning at the file and account level and close the entry, then observe a period of time and confirm that there is no rollback before rebuilding the baseline backup.

Should the contents in the recycle bin be managed?Yes, deletion only moves it to the recycle bin and is not a physical deletion. This part should be included in the inspection range during recovery and cleanup.

How often should a recovery drill be done?The common rhythm is to check the availability of backups monthly and to conduct a full recovery exercise quarterly.

Related articles

Should the new article be submitted to the search engine actively, and which companies does this protocol cover?

The proactive submission resolves the section of

2026-11-01

Where does the difference in the construction cost of static pages and dynamic websites lie, and who has higher maintenance costs later?

The quotation range of static stations during the construction period is lower, while dynamic stations are more expensive in terms of backend, database, and security patches; in the operation and maintenance period, the situation is reversed, the content update of static stations depends on technical intervention, and dynamic stations require continuous upgrades and backup work hours. Sites with frequent updates are more suitable for content systems with backend and scheduled publishing, separating the update actions from the development work hours.

2026-11-01

After the website is redesigned and the domain name is changed, should the redirection from the old address be kept up all the time?

The redirection after changing the domain name is not a permanent obligation, but addresses that have received external backlinks or have stable traffic should be kept for a long time, usually at least one year before assessment; after removing them, the old address will directly return an error page, and the external links and weight will be cut off. The cleaning order is to do address mapping first, then cut traffic, and finally batch replace the internal links, to avoid diluting the signal of multi-level redirect chains.

2026-11-01

Does a small site need to worry about crawling budget, and what two numbers does the background look at first?

The crawl budget is usually only a bottleneck on large sites or sites with frequent updates. For small sites, first understand the total number of daily crawl requests and the average response time in the search console, then deal with the three types of waste: broken links, redirect chains, and bulky site maps. The real problem for most small sites is indexing and content, not the budget.

2026-11-01

The proportion of AI crawler interception has changed between two months, is it the platform default value changed or the webmaster changed it?

The same batch of domain names in two months, the AI crawler blocking ratio has changed, most of which come from the default value of the platform going online, not the webmaster changing the configuration one by one. By looking at the direction of change, you can distinguish: the displacement is concentrated on the training and proxy sides, while the search class is basically unchanged. When comparing, first lock the same口径 and the same industry level, and then confirm the robots file, platform classification switch, and on-site exit configuration layer by layer. Changing one and testing one can only attribute.

2026-11-01

Why would the ratio of blocking different AI crawlers on the same site differ by several points?

Blocking different manufacturers' AI crawlers from the same batch of sites, the difference in blocking ratio is a few points, and the main reason is that the rules are written according to the user group name, while each proxy's identifier is not just one: omitting one will result in a difference in ratio. When checking, first distinguish between three meanings: no file, empty file, and allowed, and then rewrite the rules by grouping according to purpose, finally, verify the returned status of each one by using the site map entry and actual crawling records, rather than just looking at the configuration text.

2026-11-01

Whether there are advertisements on the page, and whether it will change whether the AI crawler can read the content.

Whether there is an advertisement on the page indeed changes whether the AI crawler can read the content: the new platform default value takes whether to display advertisements as a judgment condition, advertisements on pages are intercepted by default for training and proxy types, and search types continue to be allowed. This rule is not in the robots file, but occurs on the platform side, so there may be two sets of visibility in the same site with advertisement templates and without advertisement templates, and need to be checked separately according to the template.

2026-11-01

The new default intercept value only manages new domains, old domains need to be moved manually.

The new default blocking value on the platform only applies to newly connected domains, while the old domains already on the platform need to manually fetch and control this layer: first confirm the current effective values for training, proxy, and search categories separately, then merge them with the existing robots rules on the site, and finally verify with the real return status. The default value will not automatically overwrite existing configurations, assuming it has already taken effect is the most common judgment error.

2026-11-01