Website hacked? Warning signs and what to do, step by step

Warning signs

• Redirects: visitors (often only on phones, or only when arriving from Google) get sent to another site
• Spam in Google: searching site:yourdomain.co.uk shows pages selling things you don't sell, often in another language
• Warnings: “This site may be hacked” in Google, a red warning in the browser, or a message in Google Search Console
• Unknown accounts: new admin users, or changed passwords you didn't change
• Your host suspends the site or warns about high resource use or spam being sent
• Your emails start bouncing because your domain or server has been blocklisted

What to do, in order

1. Don't panic, and don't start deleting files. Take screenshots and note what you saw and when.
2. Contact your host and whoever built or manages the site. Ask them to check the server and take a copy for investigation.
3. Put the site into maintenance mode or take it offline if it's sending visitors to scams.
4. Change every password from a clean device: hosting account, website admin users, FTP/SFTP, database and the domain registrar. Turn on two-step verification wherever it's offered.
5. Find out how they got in before you clean up: an outdated plugin, a weak password, or unpatched server software such as PHP. Otherwise they'll be back.
6. Restore from a clean backup taken before the hack, or have a professional clean it. Then update everything: the CMS, plugins, themes and PHP.
7. Ask Google to review the site in Search Console once it's clean, so the warnings are removed.

If customer data might be involved

If your website stores personal data, such as enquiries, accounts or orders, and that may have been accessed, you may need to report it to the ICO within 72 hours of becoming aware of it, where there's a risk to people. Card payments should be handled by your payment provider, but tell them too. Our first hour after a cyber attack guide covers who to tell.

Stop it happening again

• Someone clearly responsible for updates: CMS, plugins, themes and the server's PHP
• Automatic, off-site backups, with a restore tested at least once
• Two-step verification on every admin, hosting and domain account
• Remove plugins and users you no longer use
• A web application firewall, such as Cloudflare in front of the site
• Google Search Console set up, so Google tells you about problems

Want a second opinion? Our £100 website audit checks security, hosting and backups, and the fee is credited if you go ahead with the work.