My website has been hacked: what to do, step by step

How to tell if your website has been hacked

Some attacks are obvious; others go unnoticed for months. The most common signs:

• Strange results in Google. Search for site:yourdomain.com: if you see pharmacy, casino or replica pages, or text in languages you don’t use, content has been injected.
• Redirects. Visiting from Google or a phone sends people to another site, sometimes only some visitors.
• Security warnings from the browser or Google (“This site may be hacked”).
• Warnings from your hosting provider, a suspended account or unusual resource usage.
• Administrator users you don’t recognise, or files and plugins you didn’t install.
• Security issues in Google Search Console, which flags malware or spam when it detects it.

What to do in the first hour

The temptation is to delete anything suspicious straight away. It is better to follow an order:

1. Change your passwords from a computer you know is clean: hosting, FTP, website admin, database and the associated email.
2. Tell your hosting provider. They can see logs you can’t and can often help isolate the account.
3. Back up the current state before touching anything. It helps work out how they got in and serves as evidence if needed.
4. If the website redirects to dangerous sites, put it into maintenance mode so visitors aren’t exposed while you clean it.

How a hacked website is cleaned

There are two routes, and it is worth choosing calmly:

• Restore a clean backup from before the infection. It is the fastest option if one exists and you know when the problem started. Afterwards, everything must be updated, because the vulnerability is still there.
• Clean it thoroughly. In WordPress, reinstall the core, theme and plugins from official sources, review the database and the uploads folder, and remove suspicious users and scheduled tasks.

In both cases the most important part remains: finding the way in. An outdated plugin, a pirated theme or a leaked password. If it isn’t closed, the attack comes back within days or weeks.

Recovering your position in Google

Cleaning the website doesn’t erase the trail in Google. To recover:

• Check the Security issues report in Google Search Console and, once the site is clean, request a review.
• Make spam pages return a 404 or 410 error so Google gradually drops them, and resubmit your sitemap.
• Check whether your domain has ended up on email blacklists, and review your Google Business Profile again.

It can take weeks. That is what happened to me: when this website was a WordPress site, it ended up full of injected spam pages. I rebuilt it in static HTML, made the junk pages return a 410 and Google gradually removed them.

If personal data was involved

If the website stored client data (forms, orders, registered users) and the attack may have affected it, it is a personal data breach under the GDPR:

• If it poses a risk to people, it must be reported to the data protection authority (in Spain, the AEPD) within 72 hours of becoming aware of it.
• If the risk is high, the people affected must also be informed.
• In every case, document what happened, which data was affected and what measures you took.

This guide is for information only. If your website handled sensitive data or you are unsure whether to report, consult a data protection professional.

How to stop it happening again

• Keep the core, theme and plugins updated. Most attacks exploit flaws that have already been fixed.
• Fewer plugins, and none pirated or abandoned.
• Unique passwords and two-factor authentication on the admin panel and hosting.
• Automatic backups stored off the server, and tested from time to time.
• Quality hosting that isolates accounts and monitors for malware.
• Someone keeping an eye on it. An unmaintained website becomes vulnerable; it is only a matter of time.

If your website rarely changes and you don’t need a content management system, a static HTML website removes most of these risks at the root. The pros and cons are in the guide WordPress pros and cons.

Clean it or use the moment to rebuild?

Cleaning makes sense when the attack is recent, a clean backup exists and the website otherwise works. Rebuilding makes more sense when it has been reinfected several times, runs on outdated technology or no longer convinced you. I explain it in rebuild your website or improve the one you have?

Frequently asked questions about hacked websites