Website Hacked? What to Do in the First 24 Hours

Finding out your website has been hacked is stressful: customers see warnings, pages redirect to strange sites, or your host suspends your account. The good news is that most hacked business sites can be cleaned and restored. What matters is acting quickly and in the right order.

Signs your site has been hacked

• Visitors are redirected to spam, gambling or fake pharmacy sites, often only on mobile or from Google
• Browsers or Google show a "dangerous site" or "deceptive site" warning
• Pages, links or users appear that you did not add
• Your host warns you about malware or suspends the account
• Google Search Console reports a security issue
• Search results show your site with strange titles in other languages

Step 1: Do not panic, and do not delete everything

Deleting the site destroys the evidence of how the attacker got in, and you may lose content you need. Take a full copy of the current files and database first, even though they are infected, and store it separately.

Step 2: Change every password

Change the passwords for hosting, the website admin, the database, FTP or SFTP, and the email accounts linked to them. Remove admin users you do not recognise, and turn on two-factor login.

Step 3: Contact your host

Your host can often tell you when the attack started, which files changed, and whether other sites on the account are affected. Some hosts offer scanning and clean-up tools.

Step 4: Clean or restore

• Restore a clean backup from before the hack, if you have one and know when the attack began
• Or clean the site: replace core files with fresh copies, reinstall plugins and themes from official sources, and remove unknown files and code from the database

Then update everything. If you restore an old backup without closing the hole, the attacker can come straight back.

Step 5: Close the way in

Find out how the attacker got in. The most common causes are an outdated plugin or theme, a weak or reused password, or a pirated "nulled" plugin with hidden code. Fix the cause, not only the symptoms.

Step 6: Ask Google to review the site

If Google flagged your site, fix it first, then request a review in Google Search Console under Security issues. Once Google confirms the site is clean, the warnings are removed. Google's guide for hacked websites covers each step in more detail.

Step 7: Tell the people affected

If customer data may have been exposed, tell the affected people what happened and what they should do. Depending on the data and where your customers live, the law may require you to notify them or an authority, so check what applies to you.

How to prevent it next time

1. Keep WordPress, themes and plugins updated, on a regular routine
2. Use strong, unique passwords and two-factor login
3. Remove unused plugins, themes and user accounts
4. Never install pirated plugins or themes
5. Keep backups off the server, and test that they restore
6. Use monitoring that alerts you early

These are exactly the tasks a maintenance plan covers. If you want them handled, read why choose KamiKode for website maintenance.