Your Website Has Been Hacked. Here Is What to Do, in Order.

Dollar figures in this article are US dollars. Our Australian prices are on the pricing page.

Google is showing a warning next to your listing. Or the site redirects to something selling pharmaceuticals. Or your host has suspended the account with a terse email about outbound spam.

The instinct is to restore last night's backup and get the site up. That is the single most common reason businesses get compromised twice: the backup contains the same hole, and frequently the same back door.

First Hour: Contain

1. Take the site offline or into maintenance mode. Every hour it is up serving malware deepens the reputation damage and may be actively infecting your customers.
2. Tell your host. They have seen it before, they can see server logs you cannot, and if they suspended you they will want evidence of a clean-up before restoring service.
3. Take a forensic copy of the compromised site — files and database — before changing anything. It is the only record of what happened, and you cannot get it back once you have cleaned.
4. Do not restore anything yet. You do not know when it started.

Work Out How They Got In

Skipping this step is why reinfection is so common. There are only a handful of realistic routes:

• An out-of-date plugin, theme or core. The overwhelming majority. Known vulnerabilities are published; automated tools scan for them continuously and indiscriminately. Nobody targeted you.
• A weak or reused password on an admin account, FTP or the control panel.
• A compromised computer. Malware on a machine that has saved FTP credentials.
• A neighbor on shared hosting. Poorly isolated shared environments allow lateral movement.
• A supply chain compromise — a legitimate plugin whose developer account was taken over, or which was sold and quietly repurposed.

Server access logs around the first appearance of a modified file usually answer it. If your host keeps only seven days of logs and the compromise is older, this is where that matters.

Clean It

Two viable approaches, and one that is not.

Best: rebuild from known-good sources. Reinstall the platform core and every plugin and theme from official sources at current versions. Bring across only your own content and uploads, having checked the uploads directory for files that should not be there — a PHP file in a folder of photographs is a back door, every time.

Acceptable: restore a backup from before the compromise, if you can establish when that was and your retention goes back far enough. This is the entire argument for thirty days of retention — with seven days, every copy you hold may already be infected.

Not sufficient: a cleaner plugin alone. They are useful for detection and will remove common payloads. They routinely miss modified core files and scheduled tasks that reinstate the infection later. Use one to check your work, not to do it.

Then look specifically for persistence: unknown admin users, unfamiliar scheduled tasks, modified .htaccess files, and anything injected into the theme header or footer template.

Rotate Everything

Assume every credential that touched the site is known to the attacker:

• Every CMS admin account — and delete any you do not recognize.
• Database password, and update the config file.
• FTP, SFTP and SSH keys.
• Hosting control panel and registrar.
• API keys for payments, mail and anything integrated.
• Any password reused elsewhere. Turn on two-factor authentication everywhere it is offered.

Recover Your Reputation

1. Search Console → Security Issues → Request Review. Say what happened and what you fixed. Reviews typically take a few days.
2. Check your sending reputation. Compromised sites are used to send spam, which gets your domain blocklisted. Delisting before the cause is fixed achieves nothing — see why business email goes to spam.
3. Check for spam pages in the index. Search site:yourdomain.com and look for pages you did not create. Remove them and request removal.
4. Watch Search Console for two weeks. Reinfection shows up here first.

Do You Have to Tell Anyone?

If customer personal data may have been accessed, you may have notification obligations — in Australia the Notifiable Data Breaches scheme, in the US a patchwork of state laws, and the GDPR if you have EU customers. Thresholds and timeframes differ and this is a question for a lawyer rather than a web agency. Raise it early; the deadlines are shorter than people expect.

Preventing the Second One

• Update within days, not quarters. The window between a vulnerability being published and being scanned for is measured in hours.
• Reduce what you run. Every plugin is a dependency you have accepted. Delete what you do not use — deactivated is not uninstalled, and deactivated plugins are still exploitable.
• Two-factor everywhere, unique passwords.
• Least privilege. Not everybody needs an administrator account.
• Off-site backups with real retention.
• Something watching. Most compromises run for weeks before anyone notices. Our own Findable checks weekly for injected scripts, unfamiliar links, exposed files and pages that changed without anyone touching them — the free check covers the exposure tests with no signup.

The uncomfortable truth is that almost none of this is sophisticated. It is automated, indiscriminate and entirely preventable by keeping software current — the boring maintenance that gets deferred because nothing appears to be wrong right up until it is.

Common Questions

What Should I Do First If My Website Is Hacked?

Take it offline or into maintenance mode, tell your host, and take a forensic copy of the compromised files and database before changing anything. Do not restore a backup yet — you do not know when the compromise started, and restoring one from after it simply reinstates the problem.

Can I Just Restore a Backup After Being Hacked?

Only if you can establish when the compromise began and your retention reaches further back than that. Restoring a backup taken after the intrusion restores the intrusion. It is the main reason to keep thirty days of history rather than seven, and it is why reinfection within two weeks is so common.

How Did My Website Get Hacked?

Almost always an out-of-date plugin, theme or platform core with a published vulnerability that automated tools scan for indiscriminately. The other realistic routes are a weak or reused password, malware on a computer holding saved FTP credentials, a poorly isolated shared host, or a compromised plugin developer account.

Will a Security Plugin Clean a Hacked Site Properly?

Not on its own. Cleaner plugins are useful for detection and remove common payloads, but routinely miss modified core files and scheduled tasks that reinstate the infection later. Rebuilding from official sources and carrying across only your own content is the reliable approach; use a scanner to check your work.

How Do I Remove the Google Warning After a Hack?

Clean the site properly first, then use Search Console's Security Issues section to request a review, describing what happened and what you fixed. Reviews typically take a few days. Also check for spam pages in the index and your email sending reputation, since compromised sites are commonly used to send spam.