How do I know if my website is hacked?

Look for redirects to unrelated sites, a security warning from Google, spam pages in the results of a site:yourdomain.com search, and admin users or files you did not create. One sign is enough reason to take it seriously. A free diagnosis tells you for certain.

Can you clean my hacked website without losing data?

In most cases yes. We back up first and then clean the existing files and database, so your content, orders and users stay. What cannot be restored is data that was already lost before we started and was never backed up.

Should I just restore an old backup?

Not on its own. If the entry point is still open, the site is infected again. A clean backup helps as a starting point, but only together with finding the cause, updating everything and changing every password.

How long does Google take to remove the “This site may be hacked” warning?

After the site is clean, a review request is sent through Google Search Console. Google decides, and a review can take from a few days up to a couple of weeks. We request it for you or tell you exactly how, but we cannot speed Google up.

Why was my small website hacked?

Attacks are automated and aimed at every site with a known weakness, whatever its size. An outdated plugin, a reused password or a pirated theme is enough, and attackers often want your server or your search traffic, not your data.

Is my hacked site a danger to my visitors?

It can be. Injected code may redirect visitors or try to install malware on their device. If that is happening, put the site in maintenance mode or ask your host to suspend it until it is clean.

Can you guarantee my site will not be hacked again?

No honest provider can. We clean the infection, close the entry point we find, update and harden the site, so a repeat is much less likely. Staying safe afterwards depends on updates, strong passwords and good backups.

Hacked website

Is your website hacked? What to do right now

The short answer

Visitors sent to spam, a Google warning, admin users you never created? Treat the site as compromised, but stay calm: the order of your first steps matters more than speed. They are listed below.

Get it fixed

Backup before every change
Fixed price before we start
Remote, anywhere in the world
Free diagnosis

Removing the malware is only half the job. The attacker got in through something specific, such as an outdated plugin, a stolen password or a backdoor file, and while that door stays open the infection returns. That is why we look for the way in before we clean, and why restoring an old backup on its own rarely helps.

Sound familiar?

Signs of a hacked website

Visitors are sent to spam, casino or pharmacy sites, sometimes only when they arrive from Google or on a phone
Google or your browser shows “This site may be hacked” or “Deceptive site ahead”
Searching site:yourdomain.com in Google lists pages about pills, casinos or products you never published
Admin users, plugins or files you did not create, or files changed at odd hours
Your host suspended the account, or emailed you about malware or a spam outbreak

Causes

How a website gets hacked

Outdated plugins, themes or CMS

Known security holes in old versions are scanned for and exploited automatically, often within days of being published.

Stolen or weak passwords

Reused or guessed passwords for the CMS, hosting, FTP or database give attackers a direct way in.

Pirated themes and plugins

“Nulled” premium themes and plugins often come with a hidden backdoor.

Vulnerable custom code

Weak file uploads or unsafe database queries let attackers run their own code on your site.

Another site on the same account

One infected site can spread to others that share the same hosting account or server user.

Old access that still works

A former developer, agency or lost laptop still has working hosting, FTP or admin credentials that nobody ever removed.

Try it yourself

First steps if your website is hacked

Do these first, before any clean-up. They limit the damage.

1 Make a backup copy of the files and database as they are now, so evidence is kept and nothing is lost.
2 Change all passwords: hosting panel, CMS admin, FTP or SFTP, database and the email linked to the account. Use unique, long passwords.
3 Look for admin users you do not recognise and remove them. Log out all sessions.
4 Check Google Search Console for security issues and manual actions on your site.
5 Update the CMS, plugins and themes, and delete everything you do not use.
6 If the site is harming visitors, put it in maintenance mode or ask your host to suspend it until it is clean. Do not just restore an old backup without finding the entry point.

Our approach

How we clean up a hacked website

1

You tell us what you see

Describe the symptoms and share the access we need. If visitors are being redirected or warned right now, say so and we look at that first.
2

We back up and contain

We take a full copy first, then stop the damage, for example by taking the site offline or disabling the malicious code.
3

We find the infection and the way in

We look for injected code, backdoors, rogue users and scheduled tasks, and work out how the attacker got in, so we know what to close.
4

We clean, harden and report

We remove the malware, update or replace vulnerable parts, change all passwords and keys, request a Google review if needed and send you a report.

What we need

What we need from you

Login for your hosting control panel, or SSH/SFTP access
An admin login for your CMS (WordPress, Shopify, other), if there is one
Registrar or DNS access, only if the domain is involved
What you saw, when it started and what changed just before

We ask for the least access that does the job, use a separate key per client and you can revoke it the moment we are done.

What we cannot fix

We cannot promise a site is never attacked again, and if your hosting server itself is compromised, we tell you and you may have to move. Google decides on its own warnings: we request the review, but we cannot make it faster. We cannot restore data that was never backed up.

Price

Price and what happens next

1

Free diagnosis

We find the cause and tell you what is wrong.
2

Fixed price

You get a price and a time estimate. Nothing starts without your yes.
3

Fixed and reported

We repair it, test it and send a short report.

From €450 excl. VAT

Fixed price, agreed before we start

Is it urgent? Say so in the form or in the chat. We start as soon as we can and give you a realistic time estimate with the quote. If priority work costs extra, you see that in the quote before you agree.

Get it fixed

Questions?

Hacked website: frequently asked questions

Also see

Tell us what is wrong

Answer a few short questions. You get a fixed price before we do anything.

Step 1 of 5

On which platform are you experiencing the problem?

Website App Software

Is your website hacked? What to do right now

Signs of a hacked website

How a website gets hacked

Outdated plugins, themes or CMS

Stolen or weak passwords

Pirated themes and plugins

Vulnerable custom code

Another site on the same account

Old access that still works

First steps if your website is hacked

How we clean up a hacked website

You tell us what you see

We back up and contain

We find the infection and the way in

We clean, harden and report

What we need from you

What we cannot fix

Price and what happens next

Free diagnosis

Fixed price

Fixed and reported

Hacked website: frequently asked questions

Related problems

Website down

HTTP error 502

Tell us what is wrong