Finding out your website has been hacked is stressful. Maybe a customer emailed to say your site sent them somewhere strange, or your browser is showing a red warning page. Here’s what to do in the first hour, in order.
1. Don’t panic-delete anything
It’s tempting to start deleting odd-looking files or restore the first backup you can find. Don’t, yet. Deleting files can destroy the clues that show how the attacker got in. An old backup may already contain the infection, or bring back the same hole.
2. Take a full backup of the site as it is now
Yes, the hacked version. Download the files and export the database. If something goes wrong during the clean-up, you can always get back to this point.
3. Change the important passwords
Start with your hosting account, then the website admin accounts, then FTP or SFTP and the database. Use a password manager and turn on two-factor login wherever you can.
4. Write down what you’re seeing
Screenshots of warnings, odd pages and redirects, plus roughly when they started. It saves time for whoever does the clean-up.
5. Check whether search engines have flagged you
Search for site:yourdomain.com and look for pages you didn’t create, often spam about pills, casinos or loans. If you have access to your search console account, look for security warnings there.
6. Get the entry point closed, not just the symptoms
Cleaning up malware without finding how it got in is like mopping the floor without fixing the leak. A proper rescue removes the infection, closes the entry point, updates everything, and then asks search engines and browsers to review the site.
What not to do
- Don’t email passwords to anyone. Set up access securely.
- Don’t ignore it and hope it goes away. Search warnings and spam pages get worse over time.
- Don’t pay for the cheapest “malware scan” and assume you’re done. Scanners miss a lot.
If your site has been hacked and you want it handled, our 24-hour rescue cleans it, closes the hole and hardens it, at a fixed price agreed before we start.