Website hacked: what to do, step by step

A hacked website doesn't always look hacked. Often it looks normal to you while sending visitors from Google to a casino or a fake store, or hiding hundreds of spam pages that only Google sees. Below is how to tell, what to do in the first hours, and how to prevent it.

How to tell your website has been hacked

• A red warning in Chrome or in Google results ("The site ahead contains malware", "Deceptive site ahead").
• Redirects to other sites, sometimes only on phones or only when the visitor comes from Google, so the owner doesn't notice.
• Strange pages in Google. Search Google for site:yourbusiness.com: if pages show up in Japanese, or about pharmacies or gambling, the site has been used for spam.
• New admin users in your site's dashboard.
• Emails bouncing, because your domain has landed on spam blocklists.
• Suspended hosting, or an email from your host about malicious files.
• A message in Search Console, in the Security issues report. Google treats it as the source of truth about your site's status.

The first steps, in order

1. Don't delete anything. Copy the hacked site and its database as they are. Without that copy you won't find out how they got in.
2. Change every password: hosting, the admin panel, FTP or SFTP, the database, the email linked to the site, your domain registrar. Do it from a computer you know is clean.
3. Turn on two-factor authentication everywhere you can.
4. Take the site offline or put up a maintenance page, so it stops sending visitors to dangerous sites.
5. Tell your hosting company. Many have procedures for hacked sites and can tell you which files changed and when.
6. Find out how they got in: an outdated plugin or theme, a weak or reused password, an old forgotten account, a pirated theme.
7. Clean or restore (details below).
8. Fix the cause, or the attack will repeat.
9. Ask Google for a review in Search Console.
10. Check whether personal data was exposed, and whether you have to notify anyone.

Clean, restore or rebuild

Restoring is fastest if you have a backup from before the attack. The catch is knowing when the attack happened: some infections stay hidden for weeks. Restore, then immediately update everything (WordPress, the theme, the plugins) and change the passwords, or the attacker comes back the same way.

Cleaning by hand is necessary when you don't have a clean backup. It means comparing files with the originals, deleting added files, checking the database for injected code and new users, and removing unused plugins. It's a job for someone who has done it before.

Rebuilding makes sense when the site is old, has been hacked more than once, or nobody knows any more which plugins it has and why. The content moves to a new site built clean, with the same page URLs, so you keep your Google rankings: Website redesign without losing SEO.

How to get rid of Google's warning

The warning doesn't go away by itself after cleaning. The steps, according to Google:

1. Verify ownership of the site in Search Console, if you haven't already.
2. Make sure the problem is fixed on every page in the report. Requesting a review too early extends the time the site stays flagged.
3. In the Security issues report, select Request a review and briefly describe what you cleaned and what you fixed.

How long the review takes: phishing, about a day; malware, a few days; spam, up to several weeks. Don't submit a new request until you hear back on the first.

Personal data: what the law expects

If customers' data was exposed through the site (forms, orders, accounts):

• In the US, every state has a breach notification law, with its own rules on what counts as personal information, whom to notify and how fast. The FTC's Data Breach Response guide walks through the steps, including a model notification letter. You can also report the crime to the FBI's Internet Crime Complaint Center (IC3).
• In the EU, the GDPR requires notifying the data protection authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to put people at risk (Article 33), and notifying the people affected if the risk is high (Article 34). Every breach must be recorded internally, even when you decide not to notify.

Health, financial and other regulated businesses have extra rules. When in doubt, talk to a lawyer before sending notices.

Why websites get hacked

Usually not through targeted attacks, but automatically: programs that scan the whole internet for sites running a particular vulnerable plugin version. Patchstack, a WordPress security company, counted 11,334 new vulnerabilities in 2025, 42% more than in 2024: 91% in plugins, 9% in themes and only 6 in WordPress itself. 46% had no fix available when they were made public, and for the most-attacked ones the median time to the first attacks was 5 hours.

Other common causes: reused passwords, admin accounts of former contractors, "premium" themes and plugins downloaded free from dubious sites, and shared hosting with other neglected sites.

How to prevent it

• Update constantly: WordPress, the theme and the plugins, or pay someone who does: Website maintenance cost.
• Delete unused plugins and themes, don't just deactivate them.
• Two-factor authentication for every admin, with unique passwords.
• Separate accounts, each with only the access it needs; remove the accounts of people who no longer work with you.
• Daily backups stored somewhere else than the same hosting account, and check now and then that they can be restored.
• Search Console set up, so you get an email when Google sees a problem.
• Fewer pieces to maintain. A site built in code, with no WordPress dashboard and no plugins, has far fewer doors to force. The differences: WordPress vs custom website.

At Manvro we build sites in code, with no plugins to update, and deliver WordPress sites with as few plugins as possible and two-factor login. If your site has been hacked, the first conversation is free: tell us what happened and we'll tell you whether it's worth cleaning or rebuilding. Details on our web design page.