Finding out your website has been hacked is stressful, especially when customers are the ones telling you. The good news is that almost every hacked site can be cleaned up and secured. The important thing is to act quickly and in the right order.
Signs your website has been hacked
- Visitors are redirected to spam, gambling or scam sites, sometimes only on phones.
- Google shows "This site may be hacked" in search results, or browsers show a red warning.
- Pages you didn't create appear in Google, often in another language.
- Unknown admin users appear in your website's dashboard.
- Your hosting company suspends the account or warns about malware.
- Emails from your domain start bouncing or landing in spam.
- The site suddenly becomes very slow, or content changes without anyone touching it.
What to do in the first hour
- Don't start deleting things. Removing files at random can destroy the evidence of how the attacker got in, and break the site further.
- Change your passwords. Hosting control panel, website admin accounts, FTP and database. Use new, unique passwords for each.
- Check what backups exist. Note the date of the most recent backup you're confident was clean.
- Write down what you've seen. Screenshots of warnings, odd pages or emails help whoever cleans the site.
- Get help from someone who does this regularly. Your host or a developer who handles hacked-site clean-ups.
How a hacked site gets cleaned
A proper clean-up is more than deleting the obvious bad files. It usually means:
- Scanning every file and the database for malicious code.
- Replacing the core software, plugins and themes with clean, current copies.
- Removing rogue admin users, hidden files and injected content.
- Finding and closing the way in, usually an outdated plugin, a weak password or a pirated theme.
- Hardening the site: updated software, tighter permissions and better passwords.
- Checking that email, forms and payments work again afterwards.
If the way in isn't found and closed, the site is usually reinfected within days, so that step matters more than any other.
Getting the Google warning removed
If Google has flagged your site, the warning stays until Google checks it again. Once the site is clean, the site owner can request a review through Google Search Console, under Security issues. Reviews usually take a few days. Requesting one before the site is properly clean only delays things further.
How to stop it happening again
- Keep the core software, plugins and themes updated, and remove the ones you don't use.
- Never install pirated or "nulled" themes and plugins.
- Give every person their own login, with a strong password.
- Keep regular backups stored away from the website itself.
- Have someone check on the site every day.
That last point is what our website maintenance retainer is for. If your site has been hacked right now, contact us or message us on WhatsApp and we'll get onto it.