Website Hacked? What to Do in the First 24 Hours

The obvious sign is a changed page or a ransom message. Quiet signs are more common, though. If your title appears in search results with foreign content you did not write, if visitors on their phones are thrown to another site, or if the browser says the site may be harmful, the situation is serious.

There are other signs too: an unknown user in the admin panel, a plugin you never installed, a resource warning or spam notice from your host, customers telling you they received emails you did not send. One sign is not proof, but if several appear together, assume the worst and act with care.

• Titles or descriptions in search results that you did not write
• Visitors being redirected to another site
• A harmful-site warning from the browser or the search engine
• An unknown user or plugin in the admin panel
• The server slowing unexpectedly, or a warning from your host

The aim is first to stop the damage, then to protect the evidence, then to regain control. Putting the site behind a maintenance page stops visitors being exposed to malicious code. Then, without changing anything, copy the present state of the files and the database to a separate place, and keep the server access logs too. Finding out how the attacker came in depends on those logs.

Next, change the passwords, but from a clean device. The attack may have started from your own computer, so scan that as well. Choose unguessable values, a different one for every account; the password generator on our site can help with that. Finally, write to your hosting company; they can check whether other accounts on the server were affected.

• Put the site behind a temporary maintenance page
• Keep a copy of the files, the database and the access logs as they are
• Change hosting, admin panel, database, FTP and email passwords from a clean device
• Note any unknown administrator users and plugins, and disable them
• Tell your hosting company
• Scan your own computer for malware

A backup helps only if it predates the hack. If malicious code settled in months ago, the backup itself is infected, so before restoring you must know which backup is clean. Restoring alone is not enough either: if the gap the attacker used stays open, they will come back the same way.

Proper cleanup goes in this order: content is moved onto a clean backup or a fresh installation of the software, the software, theme and plugins are updated, unused ones are removed, admin accounts are reviewed, and only then do you reopen the site. If you are unsure at any point, it is safer to inspect a copy elsewhere first and then take it live.

After the site is cleaned, the warning may not disappear by itself. The webmaster tools of search engines tell you when a security problem has been detected, and once it is fixed you need to request a new review. The request is made with a short explanation of what the problem was and how you fixed it. Review times vary, so no timescale can be promised.

Meanwhile, clean up any foreign pages left in search results: addresses you did not create should be gone, and the sitemap should be clean. Once the malicious pages are removed, it takes time for them to stop appearing in search.

The first is deleting everything without taking a copy, which loses the attacker's trail. The second is fixing only the home page and leaving the back door, so the attacker returns a week later. The third is changing passwords from the same computer that may itself be compromised.

The fourth is hiding the incident. If customer data may have been affected, a duty to notify may arise; that is a legal matter and you should ask a lawyer. On a site that holds personal data, factor this in from the first day.

• Deleting before copying
• Fixing the visible symptom without closing the gap
• Changing passwords from a possibly compromised device
• Not weighing the possibility of customer data exposure with a lawyer

On a small site with a single installation and a clean backup, the job is often manageable. But on a site with customer data, a payment flow or a membership system, or if you cannot find where the malicious code is, handling it alone is a risky choice. A poor cleanup leaves remnants and the same incident happens again.

In those cases turn to your hosting company's security support or the team that built the site. Finding the route the attacker used is as much part of the job as the cleaning. Any repair made before that is found is only temporary.

The safeguards are dull but effective. Keep software, themes and plugins up to date and delete the ones you do not use. Use strong, unique passwords and two-step verification on admin accounts, and give each person only the access they need. Keep backups off the server, in a separate place, and keep them regular.

It also helps to check the site from outside now and then with scans. Security headers and a firewall layer narrow the attack surface. None brings zero risk; the aim is to make an attack harder and to recover quickly when one happens.

• Regular updates and removal of unused plugins
• Strong, unique passwords and two-step verification
• Least privilege: everyone gets only the access they need
• Regular, tested backups kept off the server
• A firewall and security headers