What to Do If Your Website Is Hacked: A Step-by-Step Recovery Plan

If your website is hacked, act in this order: contain the damage by changing passwords and taking the site offline if it is harming visitors, keep a copy as evidence, find out how the attacker got in, clean or restore the site from a clean backup, close the hole, then ask Google to review the site. If personal data may have been exposed, check whether you must report it; in the UK that is usually within 72 hours.

Hacks are rarely personal. Most are automated attacks on outdated software, weak passwords or vulnerable plugins, and they are often found only when a customer, a browser warning or Google Search Console points them out.

How to tell your website has been hacked

Common signs include:

• Browser or Google warnings such as "This site may harm your computer" or "Deceptive site ahead".
• Strange search results: pages in other languages, or results for gambling, pharmaceuticals or counterfeit goods under your domain.
• Redirects: visitors, often only those arriving from Google or on mobile, are sent to another site.
• New admin users, files or pages you didn't create.
• Your host suspends the account or warns about unusual activity.
• Emails from your domain going to spam because your server was used to send spam.

One pattern we have cleaned up recently is worth knowing about: the hacked pages looked completely normal to the owner, but showed spam only to search engines and visitors from certain countries. The owner only noticed when unfamiliar searches appeared in Search Console. If something looks wrong in your search data, believe it, even if the site looks fine to you.

Step 1: Contain the damage

• Change every password connected to the site: hosting control panel, FTP or SFTP, database, website admin accounts and the email accounts used to reset them. Use a password manager and unique passwords.
• Turn on two-factor authentication wherever it is offered.
• Remove admin users you don't recognise.
• Take the site offline or show a maintenance page if it is redirecting visitors, spreading malware or collecting data. It is better to be briefly offline than to harm your customers.
• Tell your hosting provider. They can often see what changed, block attackers and may already have backups.

Step 2: Keep evidence before you clean

Before deleting anything, take a full copy of the hacked site's files and database, and save server and access logs. This helps you find the entry point, and you may need it if personal data was involved or you report the crime.

Step 3: Find out how they got in

Cleaning a site without closing the entry point usually means being hacked again within days. Common causes:

• Outdated software: an old CMS, plugin, theme or framework version with a known vulnerability.
• Stolen or weak passwords, often reused from another breach.
• Nulled or pirated plugins and themes, which frequently contain backdoors.
• Insecure file permissions or exposed configuration files.
• A compromised computer belonging to someone with admin access.

Server logs, recently modified files and any new admin accounts usually point to the cause. Check when the first suspicious file or account appeared.

Step 4: Clean or restore the site

You have two main options:

• Restore from a clean backup taken before the hack, then immediately update everything and change passwords. This is fastest if you know when the hack started and have a backup from before then.
• Clean the existing site: remove injected code, unknown files, spam pages and backdoors, and reinstall the core software, plugins and themes from official sources.

Either way, look for:

• unfamiliar PHP or JavaScript files, especially in upload folders
• injected code at the top or bottom of legitimate files
• spam pages or posts in the database
• changes to .htaccess or server configuration that create redirects
• scheduled tasks or cron jobs you didn't create

Attackers often leave more than one backdoor, so a scan with a reputable security tool plus a manual review is safer than either alone.

Step 5: Close the hole and harden the site

• Update the CMS, plugins, themes and server software to current versions.
• Remove plugins, themes and user accounts you don't use.
• Limit admin access to the people who need it, with two-factor authentication.
• Set up automatic, off-site backups and test that they restore.
• Add monitoring: uptime checks, file-change alerts and Google Search Console email notifications.

For sites that keep getting hacked, or depend on a long list of plugins, it can be worth rebuilding on a simpler, more maintainable setup.

Step 6: Recover in Google

If Google detected the problem, its warnings and lower visibility will stay until you ask for a review.

1. Open the Security issues report in Google Search Console. Google uses it to show its findings when it believes a site has been hacked or could harm visitors, including sample URLs.
2. Fix every listed issue on every page. Google is clear that partially fixing the site isn't enough.
3. Select Request Review and explain what happened, what you did and the result.
4. Wait, and don't resubmit. Google says reviews can take from a few days to a few weeks, and repeated requests while one is pending can lengthen the process.

Afterwards, check the Page indexing and Performance reports for spam URLs that are still indexed. Make sure they now return a "not found" or "gone" response so they drop out of results, and use the Removals tool for urgent cases.

Step 7: Check whether you must report a data breach

If your site stores or processes personal data, such as contact forms, customer accounts or order details, consider whether that data may have been accessed.

In the UK, the ICO says organisations must report certain personal data breaches within 72 hours of becoming aware of them, where feasible. Reporting is required when the breach is likely to risk people's rights and freedoms, and you must keep a record of every breach even if you don't report it. You can report before you have every detail and add more later. Similar rules apply under EU GDPR, and other countries have their own requirements, so check the rules where you and your customers are based.

If customers could be affected, for example by stolen passwords or card details, tell them clearly what happened and what they should do.

What not to do

• Don't just delete the obvious spam and move on. If the entry point is still open, it will come back.
• Don't restore a backup without checking its date. It may already contain the backdoor.
• Don't request a Google review before the cleanup is complete.
• Don't ignore it because the site "looks fine". Many hacks are designed to be invisible to the owner.

Frequently asked questions

If your site has been hacked or you want to make sure it doesn't happen, our cybersecurity and backups service covers cleanup, hardening and monitored backups, and our managed maintenance plans keep software updated so known holes get closed before attackers find them.