Website hacked? What to do in the first hour

1. Confirm what is happening (5 minutes)

Many hacks only show to search engines or to visitors arriving from Google, so the site can look normal when you type the address yourself. Check how it looks to Googlebot and to a visitor from search with the free website hacked checker, and search Google for site:yourdomain.com to spot pages you never created.

2. Contain it (15 minutes)

• Put the site into maintenance mode, or ask your host to suspend public access if it is serving malware to visitors.
• Do not delete files yet. Evidence of how the attacker got in is often in the files and logs you would remove.
• If several sites share one hosting account, assume all of them may be affected.

3. Preserve evidence (10 minutes)

• Download a full copy of the files and a database export, and label it as compromised.
• Save the web server access and error logs for at least the last 30 days.
• Note the date you first noticed the problem and anything that changed recently: plugins, themes, new users.

4. Rotate credentials (20 minutes)

Change every password that could reach the site, from a device you trust:

1. Hosting / control panel account, with two-factor authentication turned on.
2. FTP, SSH and database users.
3. CMS admin accounts; remove any admin users you do not recognise.
4. API keys stored in configuration files: payment, email and cloud keys.

5. Plan the clean-up (10 minutes)

A real clean-up has three parts: remove every backdoor (attackers usually leave several), fix the weakness they used, and verify. Restoring last week's backup without fixing the entry point usually leads to reinfection within days.

Need help now? Contact us with the word URGENT. We start with containment, then clean-up and root cause.