What to do when your website has been hacked
It usually starts with someone else telling you. A customer mentions that Chrome threw up a red page before it would show your site, or your host emails to say they have suspended the account, or you search for your own business and find a page listing counterfeit trainers under your company name.
Then there is a bad hour where nobody knows what to do and somebody starts deleting files. That hour is where most of the damage gets done, and not by the attacker.
Before anything: take a copy of the mess
The instinct is to clean. Resist it for twenty minutes.
Take a full copy of the site as it stands, infected and all, files and database together, and put it somewhere off the server. It is the only record you will ever have of what happened. Once you have overwritten it with a clean restore, the question of how they got in becomes unanswerable, and that question is the difference between fixing this once and fixing it every six weeks.
Write down the times too. When you first saw it, what the symptom was, and what changed recently. A plugin installed on the 3rd, a theme edited by somebody who has since left, a password shared over WhatsApp in June. WordPress's own documentation puts this first for the same reason we do: whoever ends up doing the work, that scrap of timeline is worth more than anything else you can hand them.
Work out what you are actually looking at
"Hacked" covers a lot of ground and the response differs.
Defacement is the loud one and, oddly, the least dangerous. Someone has replaced your home page with a message. It is obvious, it is reversible, and it usually means the intruder wanted credit rather than access.
Spam injection is the common one. Hundreds of new pages you never wrote, selling pharmaceuticals or replica watches, invisible to you and perfectly visible to Google. Often the pages only render for a search-engine crawler or for visitors arriving from a search result. You can click around your own site for a week and see nothing wrong.
Redirects are the expensive one. Everyone who types your address lands somewhere else. Except you, because the code checks for a logged-in administrator session and behaves. People lose a fortnight of enquiries to this while insisting their site is fine.
And then the quiet one nobody notices: a backdoor sitting on a site that otherwise works perfectly, waiting. No symptom at all. That is what the extra administrator account in your users list means.
Google's side, and why it is not a formality
If Chrome is showing visitors a "Deceptive site ahead" page, Google have made a decision about your site, and the way back is a process rather than a wait.
Start in Search Console, and Google's own instruction is worth following to the letter: verify you own the site, and check that no new, suspicious owners have been added. That last part catches people out. A common move is to verify the attacker's own Google account against your property, which means they get told what Google finds and can keep a foothold long after you have changed every password you can think of.
The Security Issues report tells you which category you are in. Malware, code injection, content injection, URL injection, deceptive pages, deceptive embedded resources, harmful downloads. Read it before you start cleaning, because it usually names example URLs and those are the thread to pull.
When the site is genuinely clean, you request a review. Google want three things in the request: the issue, what you did about it, and evidence of the outcome. Their guidance on deceptive-site warnings says a review can take several days. We would rather not quote a firmer number than Google do. What we can say is that a review requested on a site that still has a backdoor comes back rejected, and you have then spent several days for nothing.
Do not forget Bing, and do not forget the desktop antivirus products that keep their own lists. Google is the loudest, not the only one.
Cleaning, and the bit almost everybody gets wrong
There is one piece of technical advice in WordPress's own documentation that is worth the whole page, because it is not obvious and it quietly ruins a lot of clean-up attempts.
Do not use the reinstall button in the admin panel. The installers there tend to overwrite the files they know about, and a compromise works by adding files they do not. Download the same version you are running, and put it over the top by SFTP, so you get a real replacement rather than a tidy-up.
The same documentation says the wp-admin and wp-includes directories can be replaced wholesale, which is true and it is the fastest win available. The wp-content directory is where your theme, your plugins and your uploads live, and you have to go through it properly. Plugins are easy enough, reinstall each one fresh from source. A theme somebody customised four years ago is the hard case, and it is exactly where a modified functions file likes to sit.
Then .htaccess. It is the single most commonly altered file in a compromise and, as WordPress point out, it does not only live in the root. Copies sit in subdirectories, doing redirects nobody has looked at. Check every one.
None of that applies if your site is not WordPress, although the principle survives. Replace the application from a known-good source rather than editing what is on the server, and treat anything you cannot replace as suspect.
Reset everything, then reset it again
Passwords, and not only the obvious one. SFTP or FTP, the site's own admin logins, the hosting control panel, and the database user. All of them, all users, not just yours.
Changing a password does not sign anybody out of WordPress, which surprises people. Sessions are held separately, and the way to break them is to rotate the secret keys in the configuration file. WordPress publish a generator for fresh ones. Paste the new values in and every existing session dies, including the intruder's.
Then the part that gets skipped. Change them all a second time once the site is clean. If you reset passwords on day one while a keylogger or a backdoor was still running, those new passwords were captured as you typed them.
Scan the machine you are typing on, too. A fair proportion of website compromises start on somebody's laptop rather than on the server, with malware reading saved FTP credentials out of an editor. The NCSC's small business recovery guidance treats cleaning infected machines and changing passwords as parts of the same job, which they are.
Is this a data breach?
If the site takes contact forms, holds customer accounts, or processes orders, then somebody with access to it had access to personal data. That is a breach under UK GDPR, and the ICO's clock runs from the point you became aware, not from the point you finished working out how bad it was. Our piece on the 72-hour rule sets out what that actually involves.
We will tell you what was reachable and when, which is the technical half of that decision. We are not a law firm, nobody here is your DPO, and we do not submit anything to the ICO on your behalf. Any firm that offers to do that for you is offering something it should not.
When repairing is the wrong answer
Sometimes the honest recommendation is to stop paying to clean it.
A site running a version of its platform that has not had a security update in years cannot be made safe by removing malware from it, because the hole that let the malware in is still there and there is no patch coming. Neither can one built on a commercial theme whose licence expired in 2021 and whose author has vanished. You can clean those sites. You will clean them again in March.
Our web design page puts it in one line: we will audit what is there and tell you honestly whether repairing it or rebuilding is the better use of your money. Builds are 270, 450 or 900 pounds plus VAT depending on size, which is on the pricing page with everything else. There are sites where a rebuild is cheaper than the second clean-up, and we would rather say so than invoice you twice.
The unglamorous part that stops the repeat
Almost every compromised site we are called to has the same four things wrong, and none of them is exotic.
- Updates months behind, because updating feels risky and nobody owns the job. Our piece on patch management covers why the delay is the vulnerability.
- One shared administrator login that four people use and two of them have left. Admin rights is the same argument for desktops.
- Plugins installed once and never removed. Every one is code running on your server, whether it is switched on or not.
- Backups on the same server as the site, which means whoever got the site got the backups.
That is what a care plan is for, and it is worth being plain about what it is. Essential Care is 39 pounds a month, Business Care 69, Complete Care 99, all plus VAT, and the hosting portion is 15 pounds of each. You get UK hosting, SSL, daily backups kept for 30 days, uptime monitoring and security updates applied for you, with content changes on the upper two. It does not make a website impossible to break into. It makes it patched, backed up somewhere else, and watched, which is where the odds actually move.
If you want the whole estate looked at rather than one site, the security audit is 1,485 pounds plus VAT and covers what the internet can reach as well as what is on your machines. Details on the cybersecurity page.
What to do in the next hour
If you are reading this because it has already happened: copy the site off the server before you change anything, then open Search Console and look at who is verified on your property. Those two steps take fifteen minutes and both get harder once the clean-up starts.
If it has not happened, open your site's user list and count the administrator accounts. Then look at when the platform was last updated. Most people find at least one of those answers uncomfortable, and finding it today is considerably cheaper than finding it in a red browser window.
Frequently asked questions
How do I know my website has actually been hacked?+
WordPress publish a list of the usual indicators and it is a good one to check yourself against. Google or Bing have blacklisted the site. Your host has disabled it. Visitors say their antivirus flags it. Somebody tells you your site is attacking theirs. New administrator accounts you did not create. Or you open it and can simply see. Two quieter ones matter more because they run for months: search results for your own business showing page titles in another language, and the site behaving normally for you while redirecting visitors who arrive from Google. Attackers write code that recognises a logged-in administrator and behaves for them.
Should I just restore last night's backup?+
It is the right first move and it is not the whole job. A restore puts the files back and leaves the way in exactly where it was, so a site restored on Tuesday is often reinfected by Thursday. The order that works is to take a copy of the compromised site first, even though it is dirty, because it is the only evidence of what happened, then restore, then change every password, then patch what was out of date, then look at whether the backup you restored was itself taken after the break-in. Backups are typically kept for 30 days, which sounds like plenty until you learn the site was compromised in June.
Can I just delete the bad file and be done?+
Rarely. Deleting the one file you found treats the symptom you noticed and leaves whatever put it there. Most compromises drop more than one backdoor precisely so that removing one does not lock the attacker out, and they get hidden in places people do not look: an extra line at the end of a legitimate theme file, a .htaccess in a subdirectory rather than the root, an innocent-looking upload in the media folder. WordPress's own guidance names index.php, header.php, footer.php and the functions file as the ones to check every time, because a change to any of them affects every page request.
How do I get the Google warning removed?+
Clean the site first, then ask. Google's Security Issues report in Search Console lists what they found, which is categorised as one of several things: malware, code injection, content injection, URL injection, deceptive pages, deceptive embedded resources or harmful downloads. Once it is genuinely clean you request a review, and Google want the request to explain the issue, describe what you did and document the result, not just assert that it is fixed. Google's own guidance on deceptive-site warnings says a review can take several days. Requesting one on a site that is still infected resets you to the back of the queue, which is the most common way people make this take three weeks instead of three days.
Why has my email stopped arriving as well?+
Because a compromised website is usually used to send spam, and on shared hosting the web server and the mail server are often the same IP address. The blacklists that flag the sending IP do not distinguish between the spam and your invoice. WordPress's own documentation flags this as an increasingly common consequence. If your email lives on the same box as your site, splitting it off onto Microsoft 365 or similar is the fix, and it is worth doing before you need it rather than during a week when nobody can reach you.
Is a hacked website a data breach I have to report?+
It can be. If the site holds customer accounts, order history or form submissions and somebody has had access to them, that is a personal data breach under UK GDPR and the ICO's 72-hour clock starts when you become aware of it, not when you finish investigating. Whether it clears the reporting threshold is a judgement for you and your solicitor. We are an IT company, not a law firm, nobody here is your data protection officer, and we do not report anything to a regulator on your behalf. What we can do is establish what was actually reachable and when, which is the part the decision rests on. Our article on the 72-hour rule covers the timing.
What does it cost to have you clean it up?+
Recovery work is hourly. Without a support agreement it is 126 pounds an hour, on a plan it is 86, and evenings and weekends are 167 with a two-hour minimum, all plus VAT. That is deliberately not a fixed price, because the honest answer to how long it takes is that it depends on what we find in the first hour. If the site is old enough that nobody can update it safely, we will say so and quote a rebuild instead, because paying for repeated clean-ups on something unsupported costs more over a year than replacing it.
How do I stop it happening again?+
Nothing makes a website impossible to break into, and anyone telling you otherwise is selling something. What genuinely moves the odds is boring: updates applied within days rather than quarters, one administrator account per person with nobody sharing, plugins and themes you actually use rather than nine you installed in 2022, and backups held somewhere the web server cannot reach. Our care plans cover that side at 39, 69 or 99 pounds a month depending on the site, which includes UK hosting, SSL, daily backups kept 30 days, uptime monitoring and security updates. Hosting on its own is 15 pounds of every one of those figures.