Free guide
My website was hacked. Here is what to do first.
It feels like an emergency, and it is fixable. Work through these steps in order, and do not rush to delete things. Whether you handle it yourself or call someone, this is the plan a careful person follows.
No sign-up, nothing to download. Written by a team that has been building and looking after websites for 17 years.
Signs Your Site May Be Hacked
One of these does not prove it, but two or three together are a strong hint.
Visitors are sent somewhere else
Your address opens a different site, often an ad or a scam page.
Google shows a warning
Search results say the site may be hacked or unsafe, or your browser blocks it.
Strange pages or links appear
Pages in another language, pills and gambling links, or products you do not sell.
You are locked out
Your admin password stopped working or an unknown user account appeared.
Your host suspended the site
A notice about malware or unusual activity from your hosting company.
Email from your domain looks suspicious
Customers say they received spam that appears to come from you.
The Plan, in Order
Take them one at a time. Write down what you change so you can undo anything.
Stay calm and change passwords
From a clean computer, change the passwords for your hosting, your website admin accounts and the email tied to them. Turn on two-step sign-in where you can.
Make a copy of the current state
Before cleaning, keep a copy of the hacked site and its files. It helps find how they got in, and it protects you if cleanup goes wrong.
Take the site offline briefly if visitors are at risk
A simple maintenance page is better than sending customers to a malicious site.
Restore a clean backup, if you have one
Pick the most recent backup from before the problem started. If you do not have one, cleanup is a more careful job for a specialist.
Find and close the way in
Restoring alone does not fix it. Update the software, remove anything you do not use and check for accounts or files that should not be there.
Check Google and tell people if you must
In Google Search Console, look at the Security issues report and request a review once the site is clean. If customer information may have been exposed, there may be legal duties to notify them, so ask a professional.
Put protection in place
Automatic updates, backups, monitoring and a firewall make the next attempt much harder.
What Not to Do
These are the usual ways a bad day turns into a worse one.
- Do not delete the whole site in a panic. You may lose the only copy of your content and the evidence of how they got in.
- Do not just restore and walk away. If the hole is still open, you will be hacked again, often within days.
- Do not pay a stranger who contacts you first. Unsolicited offers to fix a hacked site are often part of the problem.
- Do not ignore it. Search engines can drop a hacked site from results, and the longer it stays, the harder recovery is.
Keeping It From Happening Again
Most hacks are boring and preventable.
Keep software current
The majority of successful attacks use problems that already have a fix.
Use unique, strong passwords
A password manager and two-step sign-in beat reusing one password everywhere.
Limit who has access
Remove former staff, vendors and old accounts as soon as they leave.
Back up, and test the restore
Automatic backups that someone has actually restored are the best insurance there is.
Watch the site
Monitoring and malware scanning catch problems in hours, not months.
Own your accounts
Know where your domain and hosting are, and make sure the logins are yours.
Questions People Ask
How long does cleanup take?
A site with a good recent backup can often be restored within hours. A site with no backup and a deep infection takes longer, because everything has to be checked by hand.
Will I lose my Google rankings?
Sometimes temporarily. Cleaning up quickly and asking Google to review the site, through Search Console, shortens the effect.
Was it my fault?
Rarely in the way people fear. Most hacks are automated attacks on outdated software or reused passwords, not a targeted attack on you.
Can you help if my designer disappeared?
Often, yes. We help business owners recover their domain, hosting and site every year. Our guide on getting your site back from a designer who vanished may help too.
If You Would Rather Hand It Over
We help clean up compromised websites, find how they got in and put protection in place, and for the sites we manage that protection (updates, backups, malware scanning and monitoring) is part of the service. See how website management works, or call and tell us what you are seeing.
Need a hand right now?
Call (360) 450-3711 or send us the address. We will tell you what we see and what to do first.
