Website Hacked? What to Do Now

• Defacement — a message, image or ransom note replacing your content.
• Malicious redirects — visitors, often only from search results or on mobile, are sent to another site.
• Unexpected pages or content — spam, pharmaceutical or gambling pages appearing under your domain.
• Compromised administrator accounts — unfamiliar admin users, editors or API keys, or you can no longer log in.
• Suspicious files or changes — recently modified files you did not touch, or new files in upload or theme folders.
• Security warnings — browsers or search engines showing "this site may be hacked" or "deceptive site ahead".
• Website unavailable — the host has suspended the account, or the site crashes or slows sharply after a suspected compromise.

1. Put the site into maintenance mode or take it offline rather than deleting anything — a holding page stops further harm to visitors.
2. Tell your hosting provider and ask whether they have seen suspicious activity or already suspended the account.
3. Pause payments or forms on the site if customer details could be at risk.

• Export web server access and error logs, FTP/SFTP logs, CMS audit logs and hosting control-panel activity — some providers rotate these quickly.
• Take a full backup of the site as it stands now (files and database), even though it is compromised.
• Screenshot what visitors see, including any browser or search-engine warnings.
• Record the list of admin, editor and API accounts as they exist now.
• Keep any notice from your host, search engine or browser vendor.

• Change passwords for CMS admins, FTP/SFTP, database, hosting control panel and domain registrar — from a device you trust.
• Rotate third-party API keys connected to the site (payment gateway, email sending, analytics).
• Turn on two-step verification (MFA) wherever it is offered.
• Remove admin and editor accounts nobody can account for.

• Compare files against a known-good backup or a fresh copy of your CMS, plugins and theme.
• Look for recently modified files in theme, plugin, upload and temporary folders.
• Check for unfamiliar scheduled tasks, database entries or redirect rules.
• Note which plugins, themes or CMS versions were out of date.

• Rebuild from a known-good source rather than patching the infected copy: clean CMS core, official plugin and theme files, and only your genuine content.
• Restore backups carefully — check logs to establish roughly when the compromise began, and restore from before that point.
• Update everything before going live again, and remove anything unused or unsupported.
• Request a review through the relevant search-console or webmaster tool once clean, so "hacked site" warnings can be lifted.

• Do not delete infected files without a backup — you may remove the only evidence of how the attacker got in.
• Do not restore an old backup without checking how far back the compromise goes.
• Do not leave the site live "to keep sales going" once you know it is serving malware or redirecting visitors.
• Do not reuse any old credentials, even slightly modified.
• Do not attempt to identify, trace or retaliate against whoever is responsible. Cyber Crisis Desk is strictly defensive: no hack-back, no tracing.

• The site processes payments and card details may have been skimmed.
• Customer personal data may have been accessed — see data breach response for what to document and who may need to be told.
• The compromise keeps coming back after cleaning.
• Your hosting or domain account itself was taken over.
• You do not have a clean backup or anyone who knows how the site was built.

In those cases, involve your developer, host or a qualified incident-response specialist. Our guide to cyber incident response for small businesses explains how to coordinate it without an internal security team.

• Keep monitoring for new files, admin accounts and redirects for several weeks.
• Turn on automatic updates and regular, tested off-site backups.
• Limit admin access to the people who genuinely need it.
• Write a short timeline of what happened and what you changed, for your records.

• Your developer or agency — if someone else manages the CMS, plugins or server.
• Your payment provider — if the site handles card payments.
• Your data-protection regulator — if customer personal data was likely accessed. In the UK that is the ICO; other countries have their own authority.
• National reporting channels — for example Action Fraud and the NCSC in the UK, and the equivalent body where you operate.

Cyber Crisis Desk is not a law-enforcement, legal or forensic service and does not report on your behalf. It prepares the structured information you need to do so.

A free Emergency Check asks a few questions about what you are seeing, whether the site is still live and whether customer data is involved. From that, the platform selects a website-compromise playbook and builds an Immediate Rescue Plan grouped by urgency.

• Client Next Action gives you one clear step at a time.
• Evidence requests tell you which logs and files to capture before a rebuild, and store them in your private case.
• Recovery tracks record which credentials have been rotated and which components rebuilt.
• Structured reports assemble the timeline and evidence for your host, insurer or regulator.
• Monitoring and closure keeps the case open until follow-up checks pass.

See how the guided workflow fits together.

• We cannot access, rebuild or administer your hosting account or CMS for you — only you or your developer can.
• We do not perform in-depth forensic malware analysis or reverse engineering, and we do not guarantee any outcome.
• We do not provide legal advice or make legal determinations for you.

Should I take the site down straight away?

Usually yes — a maintenance page or temporary offline state stops further harm to visitors and buys you time, without destroying the evidence a full deletion would.

Can I just restore yesterday's backup?

Only once you know the compromise did not exist in that backup too. Check logs to establish roughly when the attacker got in, and restore from before that point where possible.

How do I remove the "this site may be hacked" warning?

After removing the malicious content and closing the entry point, submit a review request through the relevant search-console or webmaster tool. Warnings are usually lifted once the review confirms the site is clean.

Do I need to tell customers?

If customer personal data or payment details could have been accessed, you may need to. Check your national data-protection authority's guidance early.