# Server hacked: incident response runbook for Linux and cPanel

Source: https://srvscripts.com/guides/runbook-server-compromised/
Updated: 2026-10-03
Publisher: srvScripts (https://srvscripts.com/)

An incident response runbook for a hacked Linux or cPanel server: contain it, preserve evidence, find the entry point, decide clean or rebuild, rotate credentials in the right order and tell customers.

The full guide is for srvScripts members: https://srvscripts.com/guides/runbook-server-compromised/