# Files disappeared from the server **URL:** \ **Category:** General Questions\ **Created:** [September 30, 2024, 10:41am UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073 "2024-09-30T10:41:22Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Sandra](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/s/4491bb/32.png) [@Sandra](https://forum.hestiacp.com/u/Sandra)\ **Post date:** [September 30, 2024, 10:41am UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073/1 "2024-09-30T10:41:22Z")
Hi all. On September 6, I noticed that traffic on the site had dropped. Having accessed it, I realized that there were no files on it. The files on the server have been deleted and there are no backups or anything. What could be the problem and how to solve it? ---
**Author:** ![Raphael](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/raphael/32/5217_2.png) [@Raphael](https://forum.hestiacp.com/u/Raphael)\ **Post date:** [September 30, 2024, 11:32am UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073/2 "2024-09-30T11:32:22Z")
If you do not have any backups, you’ll probaly do not get your files back. I have no idea what happened, it’s also impossible without analyse the server. Probaly easiest thing is to get you a sysadmin to check your system, then also work on a backup concept. ---
**Author:** ![Sandra](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/s/4491bb/32.png) [@Sandra](https://forum.hestiacp.com/u/Sandra)\ **Post date:** [September 30, 2024, 2:37pm UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073/3 "2024-09-30T14:37:55Z")
how can this be done? ---
**Author:** ![Raphael](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/raphael/32/5217_2.png) [@Raphael](https://forum.hestiacp.com/u/Raphael)\ **Post date:** [September 30, 2024, 3:45pm UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073/4 "2024-09-30T15:45:35Z")
> [@Raphael](#): > > you a sysadmin to check your system As I wrote in my post, or do it yourself, but you need to know how to open log files and understand them. ---
**Author:** ![hilzz](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/h/b4bc9f/32.png) [@hilzz](https://forum.hestiacp.com/u/hilzz)\ **Post date:** [October 1, 2024, 11:26pm UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073/5 "2024-10-01T23:26:25Z")
how can all your files be gone? it sounds like your server was hacked? ---
**Author:** ![hilzz](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/h/b4bc9f/32.png) [@hilzz](https://forum.hestiacp.com/u/hilzz)\ **Post date:** [October 2, 2024, 12:48am UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073/7 "2024-10-02T00:48:46Z")
i do a few things that i think help; I put all my servers behind cloudflare free plan so hackers never have visibility of server ip, greatly reduces the chances of anyone finding the server therefore cannot scan it for vulnerabilities, and adding wordfence on all websites so it blocks any malicious attacks like sql injection, XSS, and setup ssh access only to one ip via host firewall and auto update server ---
**Author:** ![hilzz](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/h/b4bc9f/32.png) [@hilzz](https://forum.hestiacp.com/u/hilzz)\ **Post date:** [October 2, 2024, 3:34am UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073/9 "2024-10-02T03:34:14Z")
from what i can see, my server is only running php-frm for backend ---
**Author:** ![eris](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/eris/32/1241_2.png) [@eris](https://forum.hestiacp.com/u/eris)\ **Post date:** [October 2, 2024, 4:45am UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073/10 "2024-10-02T04:45:38Z")
This is ridiculous the bug has been patched in 1.8 It would require for the “hacker” have access to the by 1. abusing a know bug in Wordpress or 2. have access as a client Then abuse the bug And he only has read access … ---
**Author:** ![Deepak](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/d/7bcc69/32.png) [@Deepak](https://forum.hestiacp.com/u/Deepak)\ **Post date:** [October 2, 2024, 7:58am UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073/11 "2024-10-02T07:58:18Z")
Hello Marcus! > [@eris](#): > > This is ridiculous the bug has been patched in 1.8 Thanks for your reply. Oops, did I miss something? Is php-fpm safe to use on 1.8.x stable or on 1.9.x-alpha today? I was refering to the exploit reported by Mr. Smitka in the following thread here: > [@Is Hestiacp secure from local attack?](https://forum.hestiacp.com/t/is-hestiacp-secure-from-local-attack/14909/8): > > Hello Mr. Smitka! Thanks for your marvellous research and identification of this security flaw. Would you please be kind to confirm that the following is true: Statement: If we do not use PHP-FPM at the moment or deactivate it until the HestiaCP team offers a solution, then it should be fine. Looks very logical be I want an answer from you. This vulnerability is triggered only through a local access, where an user having access to the system can elevate rights and cause damages. Sta… If yes, then I would be shocked because there was someone, who had uploaded one zip file on my VPS. There was no other framework based project installed at this time. There were only simply php scripts installed on my non-commercial project that would not give any possibility to make changes in the php.ini and upload etc. But php-fpm was installed at the time of uploading. This was before one month and I used HestiaCP 1.8.12. So if the explaoit reported by Mr. Smitka was removed i.e. patched in this version, then I will have to be much more vigilant and check that out. BTW, I have never ever used Wordpress. Nor I ever had clients or external people having any access on my VPS. The zip was uploaded on the domain running with hestia version 1.8.12. Thus, I removed php-fpm and installed 1.9-alpha. ---
**Author:** ![Raphael](https://forum.hestiacp.com/user_avatar/forum.hestiacp.com/raphael/32/5217_2.png) [@Raphael](https://forum.hestiacp.com/u/Raphael)\ **Post date:** [October 2, 2024, 12:32pm UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073/12 "2024-10-02T12:32:57Z")
yes, this bug and yes, it has been patched in the current hestia version. no need to uninstall php-fpm. ---
**Author:** ![Deepak](https://forum.hestiacp.com/letter_avatar_proxy/v4/letter/d/7bcc69/32.png) [@Deepak](https://forum.hestiacp.com/u/Deepak)\ **Post date:** [October 2, 2024, 3:09pm UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073/13 "2024-10-02T15:09:39Z")
Hello Raphael! > [@Raphael](#): > > it has been patched in the current hestia version Many thanks. I must have missed to note it. ---
**Author:** ![system](https://forum.hestiacp.com/uploads/default/original/1X/d9a5b68bf50ced83e880b56452e592b204761b19.png) [@system](https://forum.hestiacp.com/u/system)\ **Post date:** [November 1, 2024, 3:10pm UTC](https://forum.hestiacp.com/t/files-disappeared-from-the-server/16073/14 "2024-11-01T15:10:31Z")
Closed on November 1, 2024, 3:10pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.