How to Clean a Hacked Static HTML Website

People are often surprised a plain HTML site can be hacked, but it can — usually through stolen FTP or hosting credentials rather than a software flaw. The attacker edits your files or uploads new ones. Cleaning is about finding those changes, removing them, and locking down how they got in.

Step 1: Secure your access first

Since static sites are most often compromised via stolen credentials, change your cPanel and FTP passwords immediately, and scan your own computer for malware that may have stolen them. Take a full backup before editing.

Step 2: Find the injected code

Look for what was added to your HTML and JavaScript files:

• Injected <script> tags pointing to unfamiliar external domains.
• Hidden iframes or suspicious redirects.
• New files you did not upload, including stray PHP files.
• A modified .htaccess adding redirects — see fixing a malicious .htaccess redirect.

A malware scan helps locate them quickly.

Step 3: Restore or clean

If you keep local copies of your site (as most static-site owners do), the cleanest fix is to delete the site's files on the server and re-upload your known-good local copies. Otherwise, restore a clean backup, or remove the injected code by hand.

Step 4: Remove leftover files and harden

Delete any unfamiliar uploaded files, check for and remove webshells, then follow the hardening checklist — strong passwords, secure FTP, and clean local machines.

Frequently asked questions

How does a static site get hacked with no software?

Almost always through stolen FTP or hosting login details — often captured by malware on the owner's computer or via reused passwords. The attacker then simply edits your files.

Why re-upload from my local copy?

Because you know your local files are clean. Deleting the server copy and re-uploading a trusted version guarantees no injected code or hidden file survives — something manual cleaning can miss.

Should I check my own computer?

Yes. If malware on your machine stole your FTP password, changing the password alone will not help — it will just be stolen again. Scan and clean your computer as part of the fix.