Your site redirects visitors to a casino, Google shows "This site may be hacked", or your host has suspended your account. It's stressful — but a calm, ordered response limits the damage. Here's what to do, in order.
Signs Your Website Has Been Hacked
- Visitors (especially on mobile or from Google) are redirected to spam sites.
- Google results show pages or titles you didn't create, often in another language.
- Your browser or Google shows a security warning.
- New admin users you don't recognise.
- Your host reports malware or suspends the account.
- Your emails suddenly land in spam (the server may be sending spam).
Hour 1: Contain It
- Don't delete things at random. You may destroy the evidence of how they got in.
- Put the site into maintenance mode if visitors are being redirected or infected.
- Tell your host. Good hosts have security teams and clean backups.
Hours 1–3: Lock the Doors
- Change every password: website admin accounts, hosting control panel, FTP/SFTP, database, and the email account used for password resets.
- Remove unknown admin users.
- Turn on two-factor authentication for admin logins.
Hours 3–12: Clean Up
- Restore a clean backup from before the hack, if you have one — this is the fastest fix. Keep a copy of the infected version for investigation.
- If there's no clean backup, the malware has to be removed by hand: replacing core files, checking themes and plugins, and searching the database for injected code. This is specialist work — and exactly why reliable, off-site backups matter.
- Update everything: core software, themes and plugins. Remove anything you don't use.
Hours 12–24: Fix the Cause and Tell Google
- Find how they got in. Common causes: an outdated plugin, a weak or reused password, a nulled (pirated) theme, or an insecure shared server.
- Check Google Search Console. Look at Security issues, fix what's listed, then request a review. Google removes the warning once it confirms the site is clean.
- Remove spam pages from Google by making sure they return 404 or 410, and use the Removals tool for urgent cases.
Preventing the Next One
- Keep software updated — most hacks exploit known, already-fixed vulnerabilities.
- Daily off-site backups you've actually tested restoring.
- Strong unique passwords and two-factor authentication.
- Managed hosting with a firewall and malware scanning.
- Uptime monitoring so you hear about problems quickly.
These are exactly what a good website care plan covers.
Dealing with a hacked site right now? Open an urgent ticket or contact us — we clean and secure hacked sites, and can help recover lost data through our data recovery service.