Website Hacked? What to Do in the First Hour

If your website has been hacked, act quickly but calmly. First contain the damage: change passwords and take the site offline if it is harming visitors. Then work out what changed, clean or restore the site from a clean backup, close the way the attacker got in and ask Google to review the site if it shows a warning. This guide walks through the first hour, the full recovery and how to stop it happening again.

Signs your website has been hacked

• Google or your browser shows a warning when visitors open the site.
• Pages redirect to spam, gambling or pharmacy sites.
• Strange pages or links appear in Google search results for your domain.
• New admin users you didn’t create.
• Your host suspends the site or reports malware.
• Files have changed that you didn’t touch, or the site suddenly slows down.

What to do in the first hour

1. Don’t panic or delete everything. You may need evidence of what changed.
2. Change every password: hosting, website admin, database, FTP/SFTP and email.
3. Take the site offline or show a maintenance page if it is redirecting or infecting visitors.
4. Contact your host. They may have logs, backups or malware scan results.
5. Check Google Search Console for a Security Issues report.
6. Find your most recent clean backup and note its date.

What the research says: Google’s web.dev recovery guide recommends quarantining a hacked site by taking it offline, contacting your host and reviewing every user account, deleting accounts the attacker created and changing passwords for all site users, including FTP, database, admin and CMS logins. (Source: web.dev.)

The full recovery process

What the research says: web.dev sets out the recovery in order: build a support team, quarantine your site, use Search Console, assess the damage, identify the vulnerability, clean and maintain the site, then request a review. (Source: web.dev.)

1. Assess the damage

List what was changed: new or modified files, injected spam pages, redirects, new users and database changes. Search Google with site:yourdomain.com to spot spam pages that have been indexed.

2. Find the way in

Most WordPress hacks come through outdated plugins or themes, weak or reused passwords, nulled (pirated) plugins or an infected account on shared hosting. If you don’t close the entry point, the site is often re-infected within days.

3. Clean or restore

You have two options. Restore from a clean backup taken before the hack, then update everything. Or clean the infected site file by file and table by table. Restoring is faster when a reliable backup exists. Cleaning is needed when backups are missing or also infected.

Option	Best when	Watch out for
Restore a clean backup	You have a backup from before the hack	Re-applying content changed since the backup
Clean the live site	No clean backup exists	Hidden backdoors left in files or the database
Rebuild from content	The site is badly damaged and backups are lost	Time and cost of rebuilding

4. Harden the site

• Update WordPress core, themes and plugins, and delete anything unused.
• Remove unknown admin users and reset every remaining password.
• Replace nulled or pirated themes and plugins, which often contain backdoors.
• Turn on two-factor authentication for admin accounts.
• Set up regular, tested backups stored off the server.

What the research says: WordPress recommends keeping WordPress and plugins up to date and backing up the site regularly as core security practices. (Source: WordPress.org.)

Getting Google warnings removed

What the research says: Search Console’s Security Issues report groups problems into hacked content, malware and unwanted software, and social engineering. Fix issues across the whole site, because fixing only some pages won’t lift the warning, then request a review explaining what happened and what you fixed. Reviews can take from several days to a few weeks. (Source: Google Search Console Help.)

1. Fix every issue listed, using the sample URLs as a starting point.
2. Check the whole site, not just the examples Google shows.
3. Select Request Review in the Security Issues report.
4. Explain the problem, the steps you took and the result.
5. Don’t resubmit while a review is pending, as that can slow the next one.

Should you tell your customers?

If the site only showed spam pages, a short note may not be needed once it’s fixed. If visitors were redirected to harmful sites, or if the site stores customer accounts, orders or personal details, be open about it. Explain what happened, what you’ve done and whether customers should change their passwords. Depending on where you and your customers are, data protection law may also require you to report a breach, so check with your adviser if personal data could have been exposed.

What a hack costs to fix

Service	Typical price
WordPress malware cleanup (most sites)	$199 to $499, depending on the infection
Emergency same-day cleanup	From $349
Restoring a lost site from backups or archives	From $290 for up to 20 pages
Ongoing protection with a care plan	$49 to $199 a month

From our projects: Restoring and cleaning hacked sites is work clients review us for on Google. Our WordPress malware removal service confirms a fixed quote first, and our website recovery service handles sites that were lost entirely.

How to stop it happening again

• Keep core, themes and plugins updated, and remove anything you don’t use.
• Use unique, strong passwords and two-factor authentication.
• Give each person their own account with only the access they need.
• Keep daily backups stored off the server, and test a restore occasionally.
• Monitor uptime and run regular malware scans.

A WordPress care plan handles all of this for you, and our guide on restoring a website from the Wayback Machine helps if your backups are gone.

Need help right now?

If your site is down or showing a warning, contact us and tell us what you’re seeing, and we reply within one business day with questions or a written quote.