Hi, I'm Maile Ohye, here to help with the next step
in recovering a hacked site.
Touch Base with Webmaster Tools.
By now, you've completed our overview
and quarantined your site.
The goal of this fourth video is the completion of two tasks.
First, verify ownership of your site in Google Webmaster Tools.
Second, understand the type of hack caused by the cyber
criminal, whether malware or spam,
by looking at two Webmaster Tools features, Message
Center and Security Issues.
These tasks will be beneficial throughout the recovery
process.
By verifying ownership of your site,
Webmaster Tools can serve as a home base
during the recovery process.
Initially, Webmaster Tools will help you
by providing more details about your site's hacked status.
Then in the steps ahead, Webmaster Tools
can reveal whether your site has fully
recovered from the cyber criminal's wrongdoing.
It's like returning to the hospital
so laboratory tests can determine
whether an infection still persists.
As for the second task, by reviewing the message
in Webmaster Tools that pertains to your specific hack site
situation and viewing details and security issues,
you can choose a more tailored treatment plan
in the following step.
If you're watching this video and thinking,
I've already verified ownership of my site
with Webmaster Tools, that's great.
Go ahead and log into Webmaster Tools,
and then please bear with us for a few minutes.
Because as soon as we cover verification,
we'll discuss what to do next.
If you haven't used Webmaster Tools before,
let's start working on the first task
in this video, verification.
To begin, launch a web browser and navigate
to google.com/webmasters.
This page contains important links for site owners,
such as the Webmaster Help Center
with informative articles and the Webmaster Academy,
educational videos for beginner site owners.
You could always come back to google.com/webmasters,
but our current priority is to select Webmaster Tools.
Webmaster Tools requires a Google account
with a login and password.
Many people use their Gmail address.
If you don't yet have a Google account,
consider selecting the sign-up box to create one.
Once created, you can use your Google account
for any Google product, including YouTube and Gmail.
And just because you create a Google account doesn't mean
you lose your existing email address with another company.
You can still use your existing email address
and inbox elsewhere and only use your Google account
for Webmaster Tools.
Once you have an account and you're able to log in,
the Webmaster Tools dashboard appears.
As mentioned earlier, the first task
is to verify ownership of your site.
Select Add a Site, type your URL, then Continue.
This brings us to the verification page
of Webmaster Tools.
There are several ways to verify ownership, including those
listed in the tab Alternate Methods.
I won't cover each of the methods here,
because detailed help for verification can be found
at goo.gl/kQnHQ.
Just remember that when verifying,
you'll likely need to temporarily bring
your site back online.
You can take your site offline again as soon
as you're verified.
Next, since all of us have by now verified ownership while
in Webmaster Tools, navigate to the Webmaster Tools home
page, which lists your verified sites.
Often, clicking the top Webmaster Tools logo
will take you to the home page.
It's good to check that the cyber criminal hasn't already
verified ownership in Webmaster Tools
and made unwanted settings changes.
To do this on the Webmaster Tools homepage, find your site.
Select Manage Site, then Add or Remove Users.
Be sure that every user listed is authorized.
If you see an unauthorized user, you'll
need to both delete the user and any possible verification
tokens, such as a verification metatag on your home
page or an HTML file on your server.
Then be sure to review all settings
in Webmaster Tools for possible undesirable actions
by the hacker.
Next, while still in Webmaster Tools,
check for a critical message from Google
about the compromise.
There are only a few types of hack site messages.
First, is the message with Webmaster Tools that
mentions malware, such as malware infection detected.
This is the message that states some pages on your site
may infect visitors with software designed
to access confidential information
or harm their computers.
Please take note that your site was
hacked to distribute the malware.
You'll use this information to follow,
assess the damage malware in step five of the recovery
process.
Another message in Webmaster Tools
is a phishing notification.
In this message, we explain that some pages on your site
look like a possible phishing attack, in which users
are encouraged to give up sensitive information,
such as login credentials or banking information.
Assessing the damage to sites hacked with phishing pages
is much like assessing the damage
to sites hacked with spammy pages.
Therefore, if you have a phishing notification,
please be sure to follow, Assess the Damage, Hacked with Spam
in step five of the recovery process.
Alternatively, if your message doesn't mention
malware or phishing, but refers to hacking suspected,
it's likely that your site was hacked with spam.
Hacked with spam means that the cyber criminal
placed spammy pages, text, or links on your site.
Please take note that if you receive this message,
you should follow, Assess the Damage,
Hacked with Spam in step five.
It's also possible there won't be a message in Message Center,
even though your site was hacked.
This leads us to the last task for this step,
checking out the Security Issues feature in Webmaster Tools.
In Security Issues, there's more exhaustive information
about the damage on your site caused by the cyber criminal.
In this video, I'll provide a high-level explanation
of this feature.
But we'll review this feature more thoroughly
in the next step, Assess the Damage.
In Security Issues, sites infected with malware
will show a top level heading of Malware, and then categories
of malware types, such as error template injection and modified
server configuration, as well as more details and sample URLs,
and in some cases, even code snippets that
will aid your coming investigation.
Sites that were hacked to serve spam
may display the top level heading
explaining the site was detected as hacked.
Then categories of hacked types, such as content injection,
as well as more details and sample URLs.
If your site shows information in Security Issues,
you can go ahead and click to Show Details
to get a sense of what the future has to offer.
More of this feature will be covered in the next step.
Between the possible message and Webmaster Tools Message Center
and possible additional information in Security Issues,
we hope that a clear picture of the cyber criminal's damage
is beginning to come together.
And now that you verified ownership of your site
in Webmaster Tools, determined the type of damage caused
by the cybercriminal, whether spam, phishing, or malware,
and become more familiar with Message Center and Security
Issues, You're better prepared for the steps ahead.
Because you'll need to log into Webmaster Tools
again during the recovery process,
please keep your Google account information handy.
We'll see you in the next step, Assess the Damage.