Website hacked? What to do right away (and how to prevent it)

You open your website and get sent to a strange webshop. Or Google suddenly shows pages in Japanese under your company name. Or your hosting company reports that your site is sending spam. A hacked website is stressful, but with the right steps you can usually get it clean again quickly.

How do you notice your website has been hacked?

• Google shows a warning in its search results that your site may be hacked, or your browser warns visitors about it.
• Visitors are redirected to other sites, sometimes only on a phone or only when they come from Google. That is why you do not always see it yourself.
• Search Google for site:yourdomain.com. Do you see pages you do not recognise, about medicines, gambling or in another language? Then it is a hit.
• There are administrators in WordPress you do not know.
• Your hosting company takes your site offline or reports suspicious activity.
• Your site is suddenly slow or your mail no longer arrives.

What do you do right away?

1. Do not panic and do not delete anything blindly

Randomly deleting files often makes it worse and wipes the traces you need to see how the hacker got in.

2. Change all your passwords

For your hosting, all WordPress administrators, FTP or SSH and the database. Remove users you do not know. Do this from a computer you are sure is safe.

3. Notify your hosting company

They can often see what happened, sometimes have backups and can help prevent other sites on the same server from being hit.

4. Make a copy of the hacked site

Sounds strange, but that copy is needed to find the hole. Keep it separate and never put it online anywhere else.

5. Restore a clean backup, and close the hole

If you have a backup from before the hack, restoring it is often the fastest route. But without closing the hole you will be hacked again within days. Then update WordPress, your theme and all plugins, remove everything you do not use and check that no backdoors were left behind.

6. Ask Google to check your site again

If there is a warning on your site, Google Search Console shows what Google found under “Security issues”. Once everything is clean, you request a review there.

7. Think about personal data

Could the hackers reach data of customers or visitors, for example from a contact form or webshop? Then in the EU you usually have to report it to your national data protection authority within 72 hours.

How do you prevent it?

• Keep everything up to date: WordPress, theme and plugins. That is where most security holes are, and updates close them.
• Use fewer plugins, and only from reliable makers.
• Never “free” copies of paid plugins or themes: they often contain the backdoor themselves.
• Strong, unique passwords and two-factor authentication for every administrator.
• Limit login attempts, so passwords cannot be guessed endlessly.
• Automatic backups that are not only stored on the same server.
• Monitoring, so you know within the hour and not after a week.

Has your site been hacked?

We clean up hacked websites regularly, and we find out how the attackers got in so it does not happen again. Get in touch and we will take a look straight away. Want to prevent it in the future? Take a look at our maintenance plans.