Last updated:
If your website has been hacked, the order you do things in matters. The instinct is to restore a backup straight away, but restoring first and changing your passwords afterwards just hands the site straight back to whoever broke in.
Signs your site may have been compromised
- Pages you didn't create, or links to sites you've never heard of.
- Visitors redirected somewhere else, often only on phones or only from Google.
- A browser or Google warning that the site is dangerous.
- Admin users you don't recognise.
- Your hosting account suddenly sending large amounts of email.
What to do, in order
1. Change every password
Before anything else, change the passwords for your hosting account, your website's admin (WordPress or similar), FTP, and the website's database. Use new, unique passwords, and turn on two-factor authentication wherever it's offered. Then remove any admin users you don't recognise.
2. Take a copy of the hacked site
It feels backwards, but take a full copy of the compromised site before you clean anything. If you need to work out how they got in, the evidence is in there, and a clean restore destroys it.
3. Restore from a clean backup
Restore from a backup taken before the compromise. The trick is knowing when that was: hacked sites often carry hidden code for weeks before anything visible happens. If you're not sure, go back further rather than less far.
Your hosting plan includes daily backups, and our guide to backups and restore shows how to use them. If you need help finding the right one, or need one older than you can see in your hosting panel, open a ticket.
4. Update everything and delete what you don't use
Once the site is clean, update your website software, themes and plugins to their latest versions. Then delete, don't just deactivate, any plugins and themes you aren't using. A deactivated plugin is still on your server and can still be exploited.
5. Check whether Google noticed
If Google flagged your site, sign in to Google Search Console, check the Security Issues report, and request a review once the site is clean. The warning won't disappear on its own.
How sites actually get hacked
Almost never through clever, targeted attacks. Sites are broken into through an out-of-date plugin, a reused password, or an admin account that belonged to someone who left years ago. Automated tools scan the internet around the clock for exactly those weaknesses.
Keeping everything updated does most of the work. For extra protection, SiteLock scans your site for malware every day, and CodeGuard keeps independent backups you can restore from with a few clicks.
If your site is hosted with us and you think it's been compromised, open a ticket straight away. We'd rather hear about it early.