Discovering a hacked website is stressful, but a calm and ordered response makes recovery faster and reduces the chance of repeat damage. This guide covers how to recognize a compromise, what to do in the first hour, how to clean up safely, and how to prevent it from happening again.

Signs Your Website May Be Compromised

• Visitors are redirected to unfamiliar or spammy sites, sometimes only on mobile or from search results.
• New administrator accounts you did not create.
• Pages, files, or settings changed without your involvement.
• Unfamiliar spam pages or links, often in other languages, appearing on your domain.
• Browser or search engine warnings about malware or deceptive content.
• Sudden slowdowns, unusual resource usage, or your host contacting you about suspicious activity.
• Outgoing email suddenly flagged as spam.

Some of these can have innocent causes, such as a misconfigured plugin, so treat them as warning signs and investigate rather than assuming the worst.

Step 1: Stay Calm and Preserve Evidence

Before changing anything, record what you see. Take screenshots, note dates and times, and download copies of the server logs. This evidence helps your host or a security professional work out how the attacker got in. Avoid deleting files in a hurry, because you may erase clues, or remove things your site legitimately needs.

Step 2: Secure Your Accounts

Attackers often return through the same credentials. Change passwords for:

• Your hosting account and control panel.
• SFTP or FTP accounts, and any SSH keys. If you still use plain FTP, switch to SFTP, as explained in SFTP vs FTP.
• The database user, then update the application configuration to match.
• All website administrator and editor accounts.
• Email accounts connected to the domain and registrar account.

Use unique, long passwords and enable two-factor authentication wherever possible. Delete administrator accounts that you do not recognize.

Step 3: Contact Your Hosting Provider

Your host can often see activity that you cannot, such as which account was used or whether other sites on the account are affected. They may also have scanning tools or recent server-side backups. Contact them early.

Step 4: Limit the Damage

• Put the site into maintenance mode, or temporarily restrict access, if visitors are being exposed to malware.
• If the site handles personal data or payments, consider your legal and contractual notification obligations, and seek professional advice if you are unsure.
• Check whether other sites in the same hosting account are affected, since attackers often spread to neighboring directories.

Step 5: Clean Up or Restore

There are two main approaches.

Restore From a Clean Backup

This is often the safest route. Choose a backup from before the compromise, which you can estimate using the evidence from Step 1. Restore it, then immediately apply all updates and change credentials again. If you do not have a trustworthy backup, our guide on keeping website backups useful and restorable will help you build one for the future.

Clean the Existing Site

If no clean backup exists, cleaning is possible but requires care. Compare core files with fresh official copies, remove unknown files, inspect themes and plugins, and examine the database for injected content. This is time-consuming and easy to get wrong, so consider asking a security specialist.

Do not ignore permissions while you work. Overly permissive settings help attackers write files, and our article on file permissions and ownership shows what to check.

Step 6: Find and Fix the Cause

A restored site will be hacked again if the original weakness remains. Common entry points include:

• Outdated WordPress core, themes, or plugins. See how to reduce WordPress plugin risk.
• Weak or reused passwords, or login pages without protection. See how to secure a WordPress login without locking yourself out.
• Abandoned plugins and themes, including inactive ones that are still installed.
• Compromised computers or leaked credentials.
• Insecure file permissions.

Review the logs for suspicious requests, using our guide on reading a website error log to get started.

Step 7: Clean Up Search and Browser Warnings

Once you are confident the site is clean, request a review through Google Search Console if your site was flagged. Remove any spam pages and make sure your sitemap lists only legitimate URLs.

How to Reduce the Risk of Another Attack

• Update core software, themes, and plugins on a regular schedule, and remove anything unused.
• Back up files and databases, store copies away from the live server, and test restoration.
• Use strong authentication and limit administrator accounts.
• Set up uptime and change monitoring, as described in website uptime monitoring.
• Test updates on a copy before applying them to production using a staging website.
• Follow the practices in hosting security basics.

Frequently Asked Questions

Should I delete my website if it has been hacked?

Usually not. Restoring from a clean backup or cleaning the site is normally possible. Deleting everything without saving evidence or backups can make recovery harder.

How did my website get hacked?

The most common causes are outdated software, weak or stolen passwords, vulnerable plugins, and insecure permissions. Logs and your host can help identify the specific route.

Can I fix it myself?

Simple cases may be manageable, particularly with a clean backup. For complex infections or sensitive data, a security professional is a safer choice.

Need hosting that makes this easier? Explore GaugeHosting web hosting plans and get a setup built for reliable, well-supported websites.