Compromised Server or VPS, What to Do and How to Act
Realizing that something is wrong with your virtual machine or dedicated server is one of the most critical moments for anyone who manages an e-commerce store, a corporate portal, or client services. It almost always starts with seemingly inexplicable symptoms: CPU load spikes to a steady 100% in the middle of the night, hosted websites become extremely slow or unreachable, email accounts end up on blacklists due to mass spam sending, or unknown files and users appear inside the operating system.
Facing a compromised VPS not only puts the continuity of a digital project to the test, but within minutes also reveals the true value of the hosting provider you relied on. Anyone using standard unmanaged services or low-cost providers abroad quickly discovers the hard way that, in an emergency, their provider does not step in to fix the breached operating system, often simply suspending the IP address to block anomalous outbound traffic and leaving the customer completely alone to handle the damage. Understanding in detail what to do with a hacked server, how to isolate the issue, and why an infrastructure with built-in backups and Managed support like the one we offer our clients at Servereasy.it prevents these scenarios makes it possible to handle the emergency with a clear head.
The signs that confirm a system intrusion
Before taking drastic action on the machine, the first step is verifying whether you are truly dealing with an unauthorized internal intrusion or a slowdown caused by external factors. A server that fails to respond has not always been breached at the operating system level.
Anomalous processes, cryptominers, and the difference from a network attack
When an attacker manages to exploit a vulnerability in an outdated CMS, an obsolete plugin, or a weak SSH password, their main goal is almost always to exploit the server’s computing power and bandwidth without being noticed right away. Analyzing active processes (through tools like htop on Linux or Task Manager on Windows) often reveals executables with random names consuming full processor capacity to perform hidden cryptocurrency mining (cryptojacking). At other times, the intrusion turns the machine into a botnet node generating sudden spikes of outbound traffic toward unknown IP addresses, or shows successful logins from never-before-seen locations in system logs (such as /var/log/auth.log).
A very different scenario occurs when the server becomes unreachable because it is targeted from the outside by a wave of junk traffic aimed at saturating bandwidth. On services hosted in the Milan data center of Servereasy.it, this second scenario is neutralized upstream: our proprietary Always-On Anti-DDoS platform filters volumetric and application-layer attacks in real time before they even touch the virtual machine or dedicated server, allowing our clients to be certain the network is clean and focus solely on any internal software anomalies.
Hacked server what to do in the first hours without losing data
Once an intrusion inside the operating system is confirmed, haste often leads to making two opposite yet equally damaging mistakes: abruptly powering off the machine or leaving the server connected to the Internet while trying to manually delete suspicious files.
Why network isolation comes before shutting down
When dealing with a hacked server what to do in the first fifteen minutes determines whether you will be able to figure out how the intruders got in. Forcing an immediate reboot or shutdown wipes the contents of RAM, active network connections, and temporary processes launched by the attacker, erasing the evidence needed to identify the initial vulnerability.
The proper procedure is instead to disconnect the machine from public traffic (or block all inbound and outbound ports via firewall), keeping the system running to inspect and save a copy of the log files. On a traditional provider, however, blocking network ports means locking yourself out of your own server. It is precisely in these moments that the advantages of the out-of-band access tools we at Servereasy.it include for free for our clients stand out: on our Cloud VPS plans, the built-in VNC console in the Proxmox panel is always available, while on our Dedicated Servers, remote hardware access via IPMI/KVM makes it possible to work on the machine’s terminal even with the public network card completely disabled.
The illusion of manual cleanup and the need to restore from a clean backup
A widespread myth among non-professional system administrators is the idea that simply finding the malicious file or anomalous process and deleting it is enough to secure a compromised VPS. When an intruder gains elevated privileges (root or Administrator), they can modify system binaries, insert hidden SSH keys, alter scheduled tasks (cronjobs), or install rootkits invisible to standard antivirus scans, ready to reopen access just hours after the cleanup.
From an information security standpoint, the only truly reliable procedure after saving logs for analysis is formatting and reinstalling the operating system from scratch, then restoring a data backup from prior to the date of the attack. Anyone on budget hosting without automated backups unfortunately realizes at this exact moment that they have no clean restore point. To ensure our clients never find themselves in such a situation, across all VPS plans at Servereasy.it we natively include at no extra cost automated daily backups (retaining the last 7 days on separate storage in our Milan datacenter), paired with instant snapshot management.
What changes between being left alone by your hosting provider and having a Managed service
Anyone searching online for an emergency fix because their server was breached at another operator soon discovers a strict rule of the IT market: almost no provider steps in for free to clean up or fix machines hosted on third-party infrastructure, and anyone on a budget unmanaged (Unmanaged) plan with major cloud giants is left alone to decipher logs, often with their service automatically suspended by the provider’s abuse department.
For businesses, web agencies, and professionals without an in-house system administration team on duty every day of the year, the real leap in quality lies in moving projects to a domestic infrastructure and choosing a plan with Managed system administration support. When a client chooses a (managed) VPS or a Managed Dedicated Server here at Servereasy.it, they are not just purchasing hardware resources in our Settimo Milanese datacenter, but entrusting operating system security and maintenance directly to the system administrators of our NOC.
| Critical Situation | Standard / Unmanaged Provider | ServerEasy Managed Solutions |
|---|---|---|
| Prevention and Updates | Entirely the customer’s responsibility | Managed by our team (Hardening, patches, and firewall) |
| Anomaly Detection | Automatic IP block for abuse and site offline | Proactive monitoring by our NOC in Milan |
| Backup Availability | Often missing or requiring separate setup | Automated periodic backups included in the Italian datacenter |
| Recovery Management | Support does not intervene on the operating system | Direct intervention by our sysadmins on the machine hosted with us |
Preventing re-compromise and assessing GDPR obligations
Restoring a clean backup without first understanding and closing the entry point used by the attacker exposes the server to a new breach within days, as automated bots continue scanning the same IP addresses looking for the exact same vulnerability.
From log analysis to securing the new instance
Before putting the application back into production on the clean new instance, analyzing the previously saved web and system logs makes it possible to pinpoint the entry vector: in most cases, it involves outdated web components, exposed admin panels without two-factor authentication, or management ports left open to any IP address. Applying a strict server hardening procedure right from the first boot and following a precise initial configuration checklist (changing all credentials, using SSH keys instead of passwords, configuring Fail2ban, and restricting execution privileges) drastically reduces the attack surface.
Finally, when the incident involves a company server that processes or stores personal data of customers or users, the technical side intersects with legal requirements. Under Article 33 of the GDPR, the data controller is required to assess whether the intrusion resulted in a personal data security breach (Data Breach), notifying the Data Protection Authority within 72 hours of becoming aware of it if there is a risk to the rights of the individuals concerned.
Note for those looking to migrate to a protected and managed infrastructure in Italy: For organizations that no longer wish to take the risk of managing server security on their own with unsupported providers, our pages dedicated to Cloud VPS and Dedicated Servers feature all solutions hosted in our ISO 27001 certified Milan datacenter, which can be paired with the Managed system administration service handled directly by the engineers at Servereasy.it.
Servereasy Answers:
Is deleting the suspicious file with an antivirus enough to make a hacked server safe again?
When an attacker manages to enter the system with administrator privileges, simply deleting the single visible malicious file offers no security guarantee. Secondary backdoors are often left open or legitimate system files are modified to allow re-entry later on. The proper procedure always involves reinstalling the operating system from scratch on a clean machine and restoring a backup from prior to the incident.
Why did my current provider suspend my compromised VPS instead of helping me fix it?
In unmanaged hosting contracts, the provider’s responsibility stops at the operation of the physical hardware and network, while everything happening inside the operating system is the sole responsibility of the customer. When a VPS starts sending spam or outbound attacks, standard providers block the IP address to protect their network without intervening on the software. To have a team of system administrators actively handling security, updates, and machine recovery, a project needs to be hosted on a service with Managed support like the one we at Servereasy.it provide to our clients.
How do backups work on ServerEasy VPS plans in the event of an emergency or compromise?
To ensure our clients are never left without backup copies when needed, across all Cloud VPS plans at Servereasy.it we include free automated daily backups with 7-day retention. Copies are stored on dedicated storage systems always located within our Settimo Milanese datacenter, making it possible to quickly restore the instance to a clean state prior to the anomaly.
Our mission is to provide scalable, secure, and consistently reliable hosting and IT infrastructure solutions tailored to both individuals and businesses.
We believe hosting should be simple and transparent; that is why we invest in cutting-edge technologies and proprietary protection systems, ensuring performance and continuity in any situation.
With over 15 years of experience, we support our clients’ digital growth through expert assistance and constant innovation.
www.servereasy.it