🚨 Website Hacked? Here's Exactly What to Do — In Order.

Defaced homepage, strange redirects, spam pages appearing in Google, hosting suspension email — a hacked site feels like a break-in, because it is one. Panic wastes hours; order gets you back. Here's the sequence professionals follow.

1. Contain it

If you have hosting access, put the site in maintenance mode or temporarily take it offline. This stops visitors being harmed and stops the damage spreading.

2. Preserve evidence, then back up

Take a full backup of the compromised site BEFORE cleaning — it holds the clues to how they got in. Keep it separate from your clean backups.

3. Rotate every credential

Hosting, CMS admins, database, FTP, email, payment gateways. Assume all of it leaked. Enable two-factor wherever it exists.

4. Clean or restore

The fastest safe route is usually restoring a known-clean backup from before the breach, THEN patching. Manual cleaning (finding injected files/scripts) is for when no clean backup exists — it's careful work, easy to get wrong.

5. Close the door they used

Most small-business hacks come through outdated plugins/themes, weak passwords, or abandoned admin accounts. Update everything, delete what you don't use, remove old users.

6. Check Google's view

Search Console shows security warnings and lets you request a review once clean — that's how the "this site may be hacked" label comes off.

7. Reduce the attack surface for good

This is why our own builds are static-first: no database or admin panel exposed to the internet means most common attacks have nothing to grab. Worth considering in the rebuild conversation.

Need hands on it right now? We provide remote website support worldwide — any platform, any country, fixed USD quote before work starts, site backed up before we touch anything. WhatsApp us your country, site and problem and get a quote fast.