How Do You Recover a Website from a Ransomware Attack? (Without Paying)

Ransomware encrypts the files and database on your server, locks you out and demands money to unlock them. In recent years small and mid-sized websites have become the prime target of automated bots. The good news: with a properly configured backup strategy you never need to pay the ransom — instead of paying an attacker, you press the "restore" button.

1. Why Does Ransomware Hit Ordinary Backups Too?

Modern ransomware encrypts or deletes not just live data but any backups it can reach. That is why the following backups are useless against ransomware:

• Backups on the same server: If the attacker is inside the server, the backup is within their reach too.
• Plugin-based backups: Because they live inside the site, they go down with it when the site is compromised.
• Overwritable cloud backups: With stolen credentials the attacker can delete the cloud backup as well.

2. The Key Concept: the Immutable Backup

The strongest defence against ransomware is a backup kept independently and separately. When your backup sits in a storage account entirely separate from your site and server, then even if the attacker takes over your server they cannot reach it.

3. Step-by-Step Recovery During an Attack

1. Isolate: Take the server or site offline so the encryption doesn't spread.
2. Choose a clean restore point: Find an immutable backup from a date before the attack.
3. Scan, then restore: Run the backup through a malware scan before restoring, so you don't resurrect infected files.
4. Close the holes: Fix the vulnerability the attack came through (an outdated plugin, a weak password).
5. Reset every password and turn on two-factor authentication.

4. Layered Ransomware Protection with Yedekalma

• An independent location: Your backups live in external storage accounts separate from your site. If you use S3-compatible storage with Object Lock (WORM) enabled, the backup cannot be deleted or changed for the duration of the lock. Why isn't a hosting backup enough?
• Optional malware scanning: When enabled, files and the database are scanned during the backup and suspicious findings are flagged in the panel, making it easier to choose a clean restore point.
• Multiple storage destinations: The same backup at several providers; there is no single point to target.
• Optional AES-256 encryption: When enabled, the archive is encrypted on your site’s server with a passphrase only you know; we do not store the passphrase and cannot open it either.

The result: ransomware turns from a "payment crisis" into a planned piece of restore work . Paying a ransom is expensive and is no guarantee your data comes back; a clean, immutable backup, on the other hand, is a definitive answer.

Frequently Asked Questions