Security
Website Hacked? What to Do in the First Hour
Website hacked? Follow these steps: contain it, copy it, change passwords and find the entry point before you clean up and restore.
- By IT bugsolutions
- 6 min read
If your website has been hacked, work in this order: put the site into maintenance mode, save a full copy of its current state, change every password, and only then clean it and find the hole. Do not simply restore an old backup, because the weakness that let the attacker in is still there. What you do in the first hour decides how much damage you end up with.
- Contain first: maintenance mode, then change passwords for hosting, CMS, database, FTP/SSH and email.
- Copy the hacked site before you clean it. You need it to find the entry point.
- Cleaning without closing the hole means you get hacked again, often within days.
- Waiting costs you: search warnings, spam, stolen customer data and a suspended hosting account.
How do you know your website has been hacked?
Often the owner is the last to notice. A visitor tells you, Google shows a warning, or your host sends a suspension notice. Typical signs:
- Visitors land on casino, pharmacy or other spam pages, but mostly when they arrive from Google or on a phone.
- Your site shows a red browser warning such as “Deceptive site ahead”.
- Search results for your brand show strange titles, often in another language.
- New admin users appear that you never created.
- Files you did not upload sit in your hosting account, or your homepage was replaced.
- Your hosting company reports outgoing spam or a malware scan hit.
Imagine you open your own homepage and it looks fine. Then a friend opens it on their phone from a Google result and lands on a fake pharmacy. That is a typical redirect hack: it hides from the owner on purpose.
What should you do in the first hour after a hack?
Stay calm and go step by step. The order matters more than speed.
- Contain it. Switch on maintenance mode or ask your host to take the site offline. This protects visitors and stops further spread.
- Make a copy of the current state. Download all files and export the database, even though they are infected. Store the copy somewhere safe and do not open or run it. It is your evidence of how the attacker got in.
- Change every password. That means hosting panel, CMS admin accounts, database, FTP/SFTP/SSH and the email address tied to the site. Do it from a device you trust, and use a different, long password for each.
- Turn on two-factor authentication wherever it is offered, starting with hosting and email.
- Tell your host. They can often see logs you cannot, and they may have a clean backup from before the hack.
- Check what the site holds. A web shop with customer accounts or payments needs extra care, see below.
If your site stores orders, accounts or card-related data, tell your payment provider and consider whether the breach must be reported. In the EU, a personal data breach may have to be reported to the data protection authority within 72 hours. Ask a legal adviser if you are unsure; we cannot give legal advice.
What should you not do after your site is hacked?
Don’t
- Delete files in a panic before copying them.
- Restore an old backup over the site without knowing how the attacker got in.
- Reuse an old password with a small change.
- Ignore it because the homepage looks fine.
- Install five security plugins at once and hope.
Do
- Copy the current state first, then clean.
- Find the entry point, close it, then restore or clean.
- Use new, unique passwords in a password manager.
- Check the site as a stranger arriving from Google.
- Keep a short log of what you changed and when.
The restore mistake is the most common one. A backup brings back a working site, but also the outdated plugin or stolen password that caused the problem. And the backup itself may already contain the infection if the attacker was inside for weeks.
How do websites get hacked?
Most hacks are not clever. They are automated scans that look for known weak spots on thousands of sites at once. Your site does not need to be famous to be a target.
| Cause | What it looks like | Prevention |
|---|---|---|
| Outdated plugin, theme or core | Known flaw, exploited automatically | Update regularly, remove unused plugins |
| Stolen or reused password | Attacker logs in as you | Unique passwords, 2FA |
| Phishing of your logins | Fake hosting or WordPress login page | Check the address, use 2FA |
| Pirated (“nulled”) themes | Backdoor included from day one | Buy from the original author |
| Unsafe custom code | Injection or upload flaws | Code review, validate input |
Phishing deserves its own mention. One email that looks like your host and one typed password can hand over the whole site. We cover that in why phishing is still the biggest threat to website owners, and old software in the hidden dangers of outdated software.
What does it cost you if you wait?
A hacked site rarely stays the same size. It gets worse every day it stays online.
- Search visibility. Google can flag your site as unsafe and spam pages can appear under your name. Recovering that takes longer than the cleanup.
- Customers. Visitors who meet a red warning rarely come back, and a shop with a skimmer can leak payment details.
- Email. If the server sends spam, your domain can end up on blocklists and your real mail lands in junk.
- Hosting. Hosts suspend accounts that attack others, often without much notice.
- Cleanup effort. The longer an attacker is inside, the more backdoors they leave.
Attackers often leave several ways back in: an extra admin user, a small script in an uploads folder, a scheduled task. If you remove only the visible damage, they return.
Can you clean a hacked website yourself?
Sometimes. A small brochure site with one clear infected plugin, a recent clean backup and a quickly found cause is manageable. Reinstall WordPress core and plugins from fresh copies, check users, change all passwords and monitor for a few weeks.
Get help when the site is a shop, when customer data is involved, when the infection keeps coming back, or when you cannot say how the attacker got in. We repair hacked sites remotely: see how we handle a hacked website. The diagnosis is free, you get a fixed price before any work starts (from €450 excl. VAT for hacked sites), and we back up before every change.
How do you stop it from happening again?
Security works in layers. No single plugin protects you; several small habits together do.
- Keep core, plugins and themes updated, and delete what you do not use.
- Use unique passwords and two-factor authentication on hosting, CMS and email.
- Keep daily backups stored off-site, away from the server itself.
- Give each person their own account with only the rights they need.
- Scan regularly and get alerts when something changes.
Most of this is routine work nobody has time for. Our website care plans (from €99/month) cover daily off-site backups, uptime checks, safe updates with rollback and security scans. If you want to talk it through first, contact us. For wider habits, read seven simple cybersecurity measures that work.
Frequently asked questions
Also see