Immediate Steps to Take

1

Isolate Affected Systems

Disconnect compromised servers from the network. Do NOT power off — you may need forensic evidence from memory.

2

Preserve Evidence

Capture logs, screenshots, and network traffic. Do not delete or modify any files on the compromised system.

3

Rotate Credentials

Change all passwords, API keys, tokens, and SSH keys that may have been exposed. Start with admin/root accounts.

4

Enable DDoS Protection

If under DDoS, enable Cloudflare "Under Attack" mode or activate your CDN's DDoS mitigation immediately.

5

Block Attacker IPs

Check access logs for attacker IPs. Add them to your firewall blocklist or WAF rules immediately.

6

Scan for Exposure

Use our Exposure Checker to scan your domain for leaked secrets, open paths, and misconfigurations.

Request Emergency Help

Fill out this form and our security team will respond within 1 hour during business hours.

Request Submitted

Your incident report has been received. Our security team will review it and respond as soon as possible. In the meantime, follow the immediate steps on the left to contain the threat.

Run an Exposure Scan on your domain while you wait.

Free Security Tools