You open your business website one morning and notice something unusual. The homepage looks different. A strange message appears where your company introduction should be. Customers begin reporting that your website redirects them to an unfamiliar page, or Google displays a security warning when they try to visit.
At first, you wonder whether it is a temporary technical problem. You refresh the page, clear your browser cache, and try again. Nothing changes.
Then you log in to your website dashboard and discover an administrator account you do not recognise.
For a business owner, this is more than a website problem. Your website may contain customer information, receive enquiries, process orders, or represent your company's reputation online. If visitors encounter malicious content or fraudulent payment instructions, the consequences can extend beyond a few hours of downtime.
The important thing is to respond carefully rather than panic.
A website displaying an error is not necessarily hacked. A failed update, expired service, DNS problem, or configuration change can cause similar symptoms. But if you find unauthorised changes, unfamiliar administrator accounts, malicious redirects, or a credible security warning, you should treat the situation seriously until it has been investigated.
The priority is to limit further damage, protect your accounts and customers, identify what happened, and recover from a trustworthy state. Simply changing your password or deleting a suspicious file may not be enough if an attacker still has access elsewhere.
Here are ten steps to take if you suspect your website has been compromised.
Before deleting files or reinstalling your website, establish what is actually happening.
Some warning signs are obvious. Your homepage may display an unauthorised message, visitors may be redirected to suspicious websites, new administrator accounts may appear, or unfamiliar files may have been added to your hosting account.
Other signs are less visible. Your website may contain hidden spam pages, send unexpected emails, load suspicious scripts, or behave differently for visitors than it does for you.
Google may also flag a website for malware, phishing, or hacked content. Its Security Issues report in Google Search Console explains the types of problems it can identify and provides examples of affected URLs when available.
However, do not assume every website error indicates an attack. A database connection failure, an HTTP 500 error, or a sudden drop in traffic can have several causes.
Start by recording what you observe. Note the affected URLs, the approximate time the issue began, any suspicious messages, and recent changes to the website. If possible, capture screenshots and preserve relevant hosting or application logs.
Avoid repeatedly experimenting with unfamiliar files or running random cleanup scripts. Those actions can destroy useful evidence or make recovery more difficult.
If the signs strongly suggest a compromise, move quickly to containment rather than spending hours trying to diagnose everything yourself.
If the website is actively serving malicious content, redirecting customers to suspicious pages, or exposing sensitive information, preventing further harm should take priority over keeping every page online.
Contact your hosting provider or security professional and explain what you have observed. Ask whether the affected website can be isolated, placed in maintenance mode, or temporarily restricted while the incident is investigated.
The appropriate response depends on your hosting environment and the nature of the incident. A compromised WordPress installation may require a different containment approach from an application running on a virtual private server.
If your website accepts payments or handles sensitive customer information, assess whether those functions should be suspended temporarily. Do not assume that a payment form, customer account area, or database is safe simply because the homepage appears normal.
Where possible, preserve relevant logs and a snapshot of the affected environment before making destructive changes. This can help a qualified technician understand how the incident occurred.
There is an important distinction between taking a website offline and deleting it. Temporarily restricting access can help protect visitors while preserving information needed for investigation. Deleting files and databases immediately may remove evidence or destroy data that could otherwise be recovered.
If the hosting provider has already suspended your website because of malware or suspicious activity, ask what evidence is available and what must be resolved before it can safely return online.
The objective is to contain the problem without making recovery harder.
Many website owners respond to a suspected hack by changing their WordPress administrator password and assuming the problem is solved.
That is an important step, but it may not be sufficient.
Depending on how the attacker gained access, other credentials could also be exposed. These may include your hosting control panel, domain registrar, FTP or SFTP account, database account, business email, and accounts used to manage backups.
If an attacker still controls one of these accounts, they may be able to regain access even after you secure WordPress.
From a trusted device, change the passwords for affected accounts and any other accounts that may have been exposed. Use unique passwords rather than reusing the same password across multiple services. Enable multifactor authentication wherever available.
Review the list of users with administrative access. Remove accounts you cannot verify, but document suspicious changes first if an investigation is underway. Revoke unfamiliar sessions, API keys, application passwords, and other access tokens where appropriate.
Also check your domain registrar account. If someone has changed your DNS settings, they may be able to redirect visitors even if the website itself has been cleaned.
For a WordPress website, the official WordPress hacked-site guidance recommends reviewing access, changing credentials, investigating the infection, and strengthening security.
If you believe your email account has also been compromised, secure it promptly. Email is often used to reset passwords for other services, making it an important part of the recovery process.
Your hosting provider may be able to help you identify suspicious activity, review available logs, check account access, or restore a suitable backup. The level of assistance depends on the service and support policy.
When contacting support, describe the symptoms clearly rather than simply saying, "My website has been hacked."
For example, explain that unfamiliar administrator accounts appeared, that certain pages redirect visitors, or that your hosting provider reported malicious files. Include the affected domain, approximate time the issue began, and any relevant error messages.
Ask whether the provider has detected suspicious processes, unauthorised file changes, unusual resource usage, or security alerts. Find out whether the incident may affect other websites under the same account, especially if you host several websites together.
You should also ask about available backups, their dates, and whether any have been identified as potentially affected.
Remember that hosting support and malware remediation are not always the same service. A provider may be able to investigate server-level issues without offering complete cleanup of custom application code or infected website files.
If your hosting provider does not offer the required remediation, you may need a qualified website security specialist.
For SIRSTEVEHQ customers, technical and website service issues should be raised through the Client Area support ticket system so the team can review the service details and advise on the available next steps.
Do not assume that changing hosting providers will automatically remove an infection. If the vulnerable software, compromised credentials, or malicious files are moved to a new environment, the problem may follow the website.
Cleaning visible malicious content is only part of the job. You also need to understand, as far as possible, how the compromise occurred.
Common possibilities include a stolen password, an outdated plugin or theme, vulnerable application code, an exposed administrative interface, or unauthorised access through another account.
For WordPress websites, an outdated plugin is one possible explanation, but it should not be assumed without evidence. The actual entry point could be elsewhere.
Review recent changes to your website. Did you install a new plugin? Add a theme from an untrusted source? Create an administrator account? Give a contractor access? Change DNS settings? Receive a suspicious email shortly before the problem began?
Your hosting logs and application activity records may help establish what happened, although logs do not always provide a complete picture.
Pay attention to unfamiliar administrator accounts, recently modified files, unexpected scheduled tasks, suspicious redirects, and files that do not belong to the expected application.
A security professional may need to compare the affected website against clean application files, review database content, and investigate whether attackers installed backdoors that allow them to return later.
Do not assume that every unfamiliar file is malicious or that every recently modified file is suspicious. Websites routinely create and update files as part of normal operation. Changes must be evaluated in context.
Understanding the entry point matters because a website can appear clean and still remain vulnerable if the original weakness has not been addressed.
Backups can make the difference between a manageable recovery and a prolonged reconstruction project.
If you have a backup from before the suspected compromise, it may provide a route to restoring the website. However, the backup must be assessed before you use it.
A backup created after an attacker gained access may already contain malicious files, unauthorised accounts, or altered database content. Restoring it without checking could reintroduce the same problem.
First, identify when the compromise may have begun. Then review available backups and choose a version that is reasonably likely to predate the incident. If possible, have a qualified person inspect the backup before restoration.
A complete website restoration may involve files, databases, configuration settings, uploaded media, and other application data. Restoring only the homepage files may not remove malicious database entries or compromised user accounts.
For an online store, you must also consider legitimate orders and customer records created after the backup date. Restoring an older database without accounting for newer transactions could result in lost business information.
Where practical, test the restored website in an isolated environment before making it publicly accessible. Confirm that the application works, the suspicious behaviour is gone, and the original vulnerability has been addressed.
If no clean backup exists, recovery may require manual investigation and cleanup or rebuilding the website from trusted source files. This is a situation where professional assistance can be particularly valuable.
A backup is useful only if it can be restored safely and contains the information you need.
If your website contains malware, the cleanup process must be thorough enough to address both visible damage and hidden persistence mechanisms.
For WordPress, that may mean replacing compromised core files with clean copies, reinstalling trusted versions of plugins and themes, reviewing custom code, checking the database, and identifying unauthorised users or scheduled tasks.
Other website platforms have their own recovery requirements.
Simply deleting a suspicious file is not a reliable cleanup strategy. Attackers may have added malicious code in several places, modified existing files, inserted database content, or created a backdoor that allows them to return.
Likewise, reinstalling the visible website does not guarantee that the hosting account or other applications are clean. If several websites share an account, each may need to be assessed.
Do not upload random "cleaner" scripts or use commands copied from an online discussion unless you understand what they do and have appropriate backups. An incorrect command can delete legitimate data or make the website unusable.
If you are not experienced with website security, ask a qualified professional to perform the cleanup. Request an explanation of what was found, which components were replaced, how the entry point was addressed, and what was checked before the site was returned to service.
After cleanup, update the website software and remove components that are no longer supported or needed. Review the permissions and access granted to users, plugins, integrations, and service accounts.
The goal is not merely to make the website look normal again. It is to restore a trustworthy website and reduce the chance of another compromise.
Not every website hack results in customer data theft, but you should not assume that no information was exposed simply because the website is working again.
The possible impact depends on what the website stores, how the attacker accessed it, and which systems were affected.
A simple brochure website may contain little personal information. An online store, membership website, or customer portal may store contact details, order records, account information, or other sensitive data.
Review the information the attacker could potentially have accessed. If the website handles payments, determine whether payment processing occurred through an external provider or whether sensitive information was stored or processed on your own systems.
If payment credentials, customer records, or other sensitive information may have been exposed, involve the relevant service providers and appropriate legal or privacy professionals. Follow the notification and reporting obligations that apply to your business and the information involved.
Do not announce that customer data was stolen without evidence. Equally, do not tell customers that their information is safe until you have a reasonable basis for that conclusion.
If customers may have encountered fraudulent payment instructions or malicious downloads, communicate clearly about what happened, what actions they should take, and where they can find verified updates.
A thoughtful response protects customers and helps preserve trust. Concealing a material incident or making unsupported assurances can make the situation worse.
A compromised website may be flagged by Google if it contains hacked pages, malware, phishing content, or other harmful behaviour.
These warnings can affect what users see when they try to visit your website from search results or through a browser.
If you use Google Search Console, open the Security Issues report and review any listed findings. Google may provide example URLs or descriptions of the detected problem.
You can access the official Google Search Console Security Issues guidance for instructions on understanding reported issues and addressing them.
Fix the underlying problem before requesting a review. Removing a suspicious homepage message alone may not be enough if hidden pages, malicious scripts, or other compromised content remain.
Once you have completed cleanup and verified that the reported problems have been addressed, follow the review process provided by Google.
A review is not an instant guarantee that every warning will disappear immediately. Google explains that review processing can take time, depending on the issue.
Also, the absence of a warning does not prove that your website is completely secure. Search engines can detect some security problems, but they are not a replacement for a proper investigation.
Treat Search Console as one useful source of information within a wider recovery process.
Once the website has been cleaned and restored, take time to address the weaknesses that allowed the incident to happen.
Begin with the basics. Keep your content management system, themes, plugins, frameworks, and other software updated. Remove unused extensions and applications, particularly those that are no longer maintained or have known vulnerabilities.
Use unique passwords and multifactor authentication where available. Limit administrative access to people who genuinely need it, and remove access promptly when contractors or staff no longer require it.
Establish a backup routine that covers the necessary website files and databases. Keep suitable copies separate from the live environment, and periodically test restoration rather than assuming the backups will work.
Review your hosting environment and make sure it is appropriate for the website's software and workload. If you manage several websites, understand whether they share credentials, files, or other resources that could create additional exposure.
For WordPress, follow the official WordPress hardening guidance for recommendations on authentication, permissions, software maintenance, and other security measures.
You may also consider website security monitoring, a web application firewall, malware scanning, or other controls suited to your needs. These tools can improve visibility and reduce certain risks, but no single product guarantees protection against every attack.
Finally, document what happened. Record the likely entry point, the actions taken, and the changes made to prevent recurrence. If the cause remains unknown, acknowledge that uncertainty and consider further investigation.
Recovery should leave you with a better understanding of your website, not just a website that appears to work again.
You cannot guarantee that a website will never be compromised. You can, however, reduce avoidable risks and make recovery more manageable.
Use this checklist as a starting point:
For small businesses, the best approach is one you can maintain consistently. A sensible security routine is more useful than installing numerous tools you do not understand or never check.
When a website has been hacked, the pressure to restore it quickly is understandable. Every hour offline may mean missed enquiries, lost sales, and customers wondering whether your business is still operating.
But rushing to delete files, reinstall software, or change one password can leave the underlying problem unresolved.
Start by identifying the warning signs, limiting further harm, securing affected accounts, and preserving useful evidence. Work with your hosting provider or a qualified security professional to investigate the incident, clean the website, and restore a trustworthy version.
Then strengthen your backups, access controls, and software maintenance practices so you are better prepared next time.
If you run a WordPress website, keep in mind that the platform itself is only one part of the security picture. Your plugins, themes, passwords, hosting configuration, and recovery process also matter.
SIRSTEVEHQ provides hosting services for businesses that need a place to run their websites, including WordPress Hosting and other hosting options. Choose a service that fits your technical requirements, understand the security and backup arrangements available, and maintain responsibility for the security of your own website.
The real goal after a website hack is not simply to get back online. It is to recover safely, protect the people who rely on your business, and make the next incident less likely to happen.
Comments (0)
No comments yet. Be the first to comment!