Website hacked? What to do, step by step

Sometimes a customer emails to ask why your homepage redirects to a casino. Sometimes Google adds “This site may be hacked” under your listing. And sometimes nobody notices until the host suspends the account for sending spam. Whichever way you found out, the order of the next steps matters more than speed, and it doesn’t start with deleting files.

Website hacked: what to do right now

1. Protect visitors. Turn on maintenance mode or ask your host to suspend the site for now. Anyone visiting may be served malicious code.
2. Take a snapshot. Download all files, a database dump and the access logs. Yes, including the infected files. Without them you won’t find out how the attacker got in.
3. Change credentials. Hosting control panel, SFTP and SSH, the database password (and update it in the config file), every CMS admin account. Do it from a computer you trust.
4. Tell your host. They can see things you can’t, such as other affected accounts on the same server or outgoing spam.
5. Only now clean up. More on that below.

If the site itself hasn’t changed but the domain points to someone else’s server, the problem sits one layer higher. Read domain hijacked instead.

Signs your site has been compromised

Not every break-in is visible. These come up again and again:

The second one is often the last to be noticed, because the homepage looks fine. Searching Google for site:yourdomain.com shows whether pages you never created are indexed.

Finding malicious code from the shell

With SSH you get answers faster than through a control panel. All PHP files changed in the last seven days:

find /path/to/site -name "*.php" -mtime -7 -ls

PHP files in upload directories almost never belong there:

find /path/to/site/wp-content/uploads -name "*.php"

On WordPress, WP-CLI compares your files against the official checksums and lists every difference:

wp core verify-checksums
wp plugin verify-checksums --all
wp user list --role=administrator

The plugin check only works for plugins from the wordpress.org directory. Premium plugins have to be compared against a freshly downloaded copy.

Grepping for base64_decode or eval( gives leads but also false positives, since legitimate plugins use those functions. It gets suspicious when long, unreadable strings sit next to them.

Restore clean rather than patch

Deleting the obvious files misses the back door stored in a widget option in the database. The safer route:

• A backup from before the break-in. If you know roughly when it started, restore something older. Many hosts keep 7 to 30 days of backups.
• No clean backup? Reinstall the CMS core, plugins and themes from the original source and carry over only content: uploads (after checking for PHP files) and the database (after checking for unknown admins and suspicious options).
• Then close the hole. Update everything, delete unused plugins rather than just deactivating them, check the PHP version.

Only lift maintenance mode once the hole is closed. Otherwise you’ll be back here next week.

Clearing the Google warning

If Google has flagged the site, Google Search Console lists the affected URLs under “Security issues”. After cleanup, request a review there and describe what you did: what the malware was, how you removed it, which hole you closed. Specific beats vague.

If your domain was also used to phish other people, you may receive abuse reports from your registrar or host. How those reports work from the other side is explained in report a phishing site.

Data protection deadlines

If you run a shop or membership site, or store form submissions, personal data may have leaked. Under the GDPR and the UK GDPR, you have 72 hours from becoming aware of a personal data breach to notify the supervisory authority, unless the breach is unlikely to put people at risk. In the UK that is the ICO. Where the risk is high, the affected people must be told as well.

The clock runs over weekends. If you don’t know everything yet, report what you know and follow up. In the US there is no single federal rule; notification duties depend on the state where affected people live and on your sector.

It is also worth reporting the crime. In the US, IC3 takes reports. In the UK, Report Fraud does, and the NCSC publishes guidance for small organisations recovering from an incident.

So next time is faster

A hack is also a test of how prepared you were. What shortens recovery most: automated backups stored away from the web space, a list of every login kept somewhere safe, and two-factor sign-in everywhere it is offered, including your host and your registrar. Setting it up for the domain account is covered in 2FA for domain accounts.

When domain and hosting sit with the same provider, one stolen password gives an attacker both. Many people split them: domain at a pure registrar, hosting elsewhere. At betadomain you can manage a .com domain separately from hosting with DNSSEC, at a price that stays the same at renewal.

Hacked sites are often followed by phishing on lookalike names. Before someone else does it, check whether the obvious spelling variants of your domain are still available.

Step by step

1. Isolate the siteSwitch on maintenance mode or ask your host to suspend the site so visitors are not served malware.
2. Preserve evidenceCopy all files, a database dump and the server logs before deleting anything.
3. Rotate every credentialChange passwords for hosting, SFTP, SSH, the database and every CMS admin; check SSH keys and remove unknown admin accounts.
4. Restore cleanRestore a backup from before the compromise, or reinstall core, plugins and themes from their original sources.
5. Close the holeUpdate the CMS, plugins and PHP version, delete unused plugins and check file permissions.
6. Notify and request reviewNotify the regulator within 72 hours if personal data was affected, then request a review in Google Search Console.