How to fix a hacked website, and when to call someone.
Finding out your website was hacked feels awful, and the first instinct is to start deleting things. Hold off. Most of the damage in a hack comes from what people do in a panic in the first hour. Here is what to look for, what to do first, and what a real fix involves.
Signs your website has been hacked
Some hacks are loud. Google shows a red warning screen before anyone can reach your site, or your host shuts the account down, or a customer emails to say your homepage is selling something you have never heard of.
Most are quiet, because a quiet hack earns the attacker more. Watch for your site sending phone visitors off to spam while it looks normal on your own computer, admin users you did not create, and strange pages when you search Google for site:yourdomain.com. If you see any of these, assume the worst until someone has checked.
What to do in the first hour
Change your passwords, starting with your hosting account, then your website login, then the email tied to both. Do it from a computer you trust. Then tell your hosting company, since many of them can see what happened from their side and will want to know anyway.
Do not start deleting files, and do not restore an old backup yet. Make a full copy of the site as it is right now. That copy is how whoever fixes it works out how the attacker got in, and if you take payments or store customer information, it may matter later.
How a hacked website actually gets fixed
A real fix has four parts. Find the way in, which is usually an outdated plugin, a weak password, or old software nobody updated. Remove the bad code, including the hidden backdoors attackers leave behind so they can come back. Close the hole so the same trick does not work twice. Then clean up anything the hack left in Google.
That last part trips people up. If Google flagged your site, you have to ask it to take another look once the site is clean. You do that through Google Search Console. Reviews for malware usually take a few days, while sites that were hacked to publish spam can take several weeks. If spam pages from the hack are still showing up under your name, our post on why hacked pages stay in Google explains what to do about them.
Why hacked sites get hacked again
The most common story we hear goes like this: the site got hacked, somebody cleaned it, and a week later it was hacked again. That almost always means one of two things. Either a backdoor was left behind, or the hole they came through was never closed.
Restoring a backup has the same trap. If the backup is from before the hack but the outdated plugin that let them in is still sitting there, you have simply rolled the clock back to the day before they walked in the first time.
When to do it yourself and when to call someone
You can reasonably handle it yourself if the site is small, you have a backup you know is clean, you know exactly how they got in, and Google has not flagged anything.
Call someone if Google is showing a warning, if you take payments or keep customer information, if it has been hacked more than once, or if you simply do not know how they got in. Every day a warning stays up costs you customers who never tell you they left. That is what our hacked website repair service is for.
Frequently asked questions
Will my hosting company fix my hacked website?
Some hosts will scan for malware or quarantine infected files, but most will not clean up your actual website or find how the attacker got in. Many simply suspend the account until the problem is gone. Ask them what they cover before counting on it.
How long until Google removes the warning?
After the site is clean and you request a review in Google Search Console, malware warnings usually clear in a few days. Sites hacked to publish spam can take several weeks.
Can I just restore a backup?
Only if you are sure the backup is from before the hack and you have closed the hole the attacker used. Otherwise you will very likely be hacked again the same way.
Ready to out-rank, out-design, and out-sell your competition?
Tell us what you're trying to grow. You'll get a straight answer, a clear plan, and a free quote — usually within one business day.