A page changed without your approval, an unfamiliar administrator or an unexpected change to recovery details deserves prompt investigation. A failed login or an isolated alert does not, however, confirm a compromise. The aim is to limit unwanted access, preserve useful information and organize recovery with the people responsible.
1. Use a trusted access route and report the situation
From a trusted device, open your Client Area directly and report the affected service. Avoid links and attachments in the suspicious message. If you cannot sign in, use our contact form and explain how to reach you without relying on a possibly compromised mailbox. Account access must be verified before recovery assistance.
Also notify the person who manages your website or IT. If your computer appears compromised, stop using it to enter new credentials and have it examined. Our team can check the Nuagerie service and coordinate suitable measures with you; the scope of an intervention depends on the incident and service.
2. Preserve the facts before changing the site
Include these details in your request:
- the domain and affected functions, without posting this information in a public forum;
- the first observation and last known normal operation, including times and time zone;
- the exact message, visible changes and alerts received;
- recent planned changes and the actions you have already taken in response.
Keep original messages and logs already available to you. Include only useful screenshots, masking information unrelated to the incident. Do not put passwords, temporary codes, private keys, reset links or a complete archive in the message. Ask for an appropriate transfer method if files are needed.
Do not bulk-delete unfamiliar files, logs or users, or reinstall the site as an attempted fix. Those actions can remove useful evidence. The official guidance on responding to a compromise emphasizes preserving evidence and having the incident investigated.
3. Secure the affected access
From the trusted device, promptly replace passwords for affected accounts with long, unique values. Also secure the recovery email account if it is affected. If a password was reused elsewhere, change it on those services too. Our password guide covers good practices.
Review recovery details and authorized access where you can view them. Report changes you do not recognize. Confirm how unauthorized access and affected sessions or tokens can be revoked for each service; changing a password does not establish that every access route has been removed. Enable multifactor authentication where available, without treating it as a cleanup of the account.
4. Identify the affected services
The Client Area, cPanel, mailboxes, website administration and integrations can have separate credentials. With the people responsible, review administrator accounts, collaborator access and application connections. Coordinate changes to secrets used by the website or an integration to avoid another interruption; do not blindly remove database users.
For suspicious messages sent from your address, see our compromised or spoofed email guide. If the website puts visitors at risk, report that so appropriate access restrictions can be agreed promptly.
5. Plan recovery and checks
Cleanup, updates and any restoration need to address the identified cause and preserve useful recent changes. An older copy may already be affected. Before replacing data, confirm the date and scope using our restoration guide.
Then check essential functions, access and available alerts. A normally displayed website or a scan with no detections does not, by itself, establish that the compromise is gone. Keep a record of the work and report any recurrence. Following up on these checks helps plan the return to normal operations and reduce the risk of recurrence.
