Website hacked: what to do in the first 24 hours

You open your own website and see a strange page, a warning from Google, or a business site that suddenly talks about medication or cheap watches. Website hacked, what to do? Take a breath, then work in the right order. The order matters more than speed.

If you delete everything straight away or restore a backup, you often wipe the evidence and leave the back door open. Below is a checklist for the first 24 hours. You don't need to be a specialist to take the first steps. For the later steps, we tell you honestly when it's better to bring in someone else.

Step 1: check whether your site is really hacked

Not every outage is a hack. A broken plugin or an expired certificate can look just as scary. These are signs that do point to a hack:

• Your site shows pages or text you didn't create, for example in another language or about products you don't sell.
• Visitors are redirected to another website, often only from Google or only on mobile. That's why you sometimes don't see it yourself.
• Google shows a warning in the search results, or your pages have strange titles.
• Your hosting provider reports suspicious activity, or your site has been suspended.
• There are new administrators in WordPress that you don't know.
• Your server is suddenly slow or sends email you didn't ask for.

Not sure? Run the free website check, which looks at security, among other things. It's not a forensic investigation, but it shows whether something is visibly wrong.

Step 2: shield the site, first hour

As long as the hacker is in and visitors keep coming, the damage grows. Visitors can pick up malware and Google can flag your site as dangerous. So close the door first.

1. Take the site offline or put it in maintenance mode. A simple maintenance page is fine. If you can, have it return a 503 status, so Google understands it's temporary.
2. First change your own password, from a clean device. If your own laptop is infected, a new password won't help. So run a virus scan before you continue.
3. Lock down access to the server. Change FTP and SSH passwords and remove accounts you don't recognize.
4. Warn your hosting provider. They can often see in the logs where it went wrong and can help with blocking access.

This takes about half an hour to an hour. It feels like little progress, but this stops the bleeding.

Step 3: secure the evidence before you delete anything

First make a copy of the hacked site, files and database, and store it separately. That feels odd, because you're saving an infected site. But without that copy, you can't find out later how the hacker got in. And if you don't know that, it will happen again.

Also keep the web server log files if you can download them. Do not put the copy back in a publicly accessible place. For a regular business owner, this is about fifteen minutes of work in Plesk or via your hosting provider. If you have customers' personal data on the site, also write down when you discovered the hack. You will need that later (see below).

Step 4: clean up or restore a backup

This is the step where most people start, and where most mistakes are made. You have two routes.

Route A: restore a clean backup

Usually the fastest and safest route. The catch: the backup must be from before the infection. But you often don't know exactly when the hack began. Look at the date the first strange files were created and choose a backup from before that. You can read how this works with us in creating and restoring a backup.

Update everything right after restoring: WordPress, theme and plugins. The backup also contains the vulnerability the hacker used to get in. If you don't do this, you will be back to square one within a few days.

Route B: clean up manually

If you don't have a usable backup, you have to do the work yourself. It is a lot of work and hard to get completely right. These are the places to look:

• Your uploads folder. It should contain images, not PHP files.
• Files with odd names or recent modification dates that you can't explain.
• You .htaccess, where invisible redirects are often placed.
• The user list in WordPress, for administrators that aren't yours.
• Unused or unknown plugins and themes. Remove what you don't use.

With WordPress, you can replace the core files with a clean download of the same version. In Plesk, WordPress Toolkit can compare the core files with the original, which saves searching. Reinstall plugins and themes from a trusted source.

Be honest with yourself. A well-hidden backdoor often can't be found by eye. If after a few hours you're still not sure everything is clean, have someone else do it. Our cybersecurity team does incident response, which means finding the cause and closing the leak.

Step 5: renew passwords and access

Only do this after cleaning, or at least do it again afterwards. Otherwise you give a new password to a site where the hacker is still watching. Go through:

• All WordPress users with admin rights. Have them log out and choose new passwords.
• FTP, SSH, Plesk and your hosting account.
• The database password. You also change this in wp-config.php, otherwise your site will be unreachable.
• The security keys in wp-config.php. Replacing them makes all existing sessions invalid.
• Your email account and domain account. A hacker can do more damage there than on the site itself.

Use a unique password from a password manager everywhere, and turn on two-step verification where you can. Reused passwords are a common reason hacks happen, so change them in other places where you used them too.

Step 6: report, check and let Google know it is fixed

If customers' personal data has been viewed or stolen, you may have to report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), within a short deadline. Look this up or ask someone about it. This is the moment to have the date of discovery at hand.

Also check:

• Google Search Console: is there a message about security issues? After the cleanup, you can request a new review there.
• Are there strange pages in Google? Search on your own domain and check whether spam pages have been indexed. Remove them and make sure they return a 404 or 410.
• Is unwanted email being sent from your domain? Then your sender reputation may have been damaged. Properly configured SPF, DKIM and DMARC help prevent misuse of your domain, as explained in Setting up DMARC for Microsoft 365 and Google.

Do you have a web shop or customers who logged in to your site? Tell them briefly and factually what happened and what they need to do. Usually that means changing a password.

Preventing it from happening again

Almost every hack on a small site comes down to a few things. This works best:

• Keep everything up to date. Outdated plugins are the most common way in. Turn on automatic updates where you can.
• Remove what you don't use. Every plugin and every old theme is a possible weak spot.
• Strong passwords and two-step verification for all administrators.
• Daily backups, and test now and then whether you can actually restore them.
• Don't give users more permissions than they need. Not everyone has to be an administrator.
• Monitoring. The sooner you notice, the smaller the damage.

On our WordPress hosting, automatic updates, daily backups and DDoS protection are turned on by default. It does not remove every risk, because a weak password is still a weak password. But it saves you a lot of hassle.

What to do now

Is your site on fire right now? Then go through this list, in this order:

1. Take the site offline and scan your own computer.
2. Change your passwords for hosting, FTP and SSH, and call or email your hosting provider.
3. Make a copy of the hacked site and store it separately.
4. Restore a clean backup or clean up manually, and update everything right away.
5. Renew all passwords and keys again and check users.
6. Check Google Search Console, email and any reporting obligation.

Do you want a second pair of eyes, or are you not sure your site is really clean? Then read our short guide my website has been hacked: what to do first, or ask a specialist to take a look. That costs less than a second hack.

Frequently asked questions

How long does it take to recover a hacked website?

With a clean backup, you are often done within a few hours. Cleaning up manually quickly takes a day or longer, especially if you also have to find the cause. Recovery in Google, such as getting a warning removed, can then take a few more days.

Can I clean up a hacked website myself?

Sometimes, if you have a clean backup and know how to check files and users. The risk is hidden backdoors that you can't see. If the site matters for your revenue, or it holds customer data, have a specialist take a look.

Will my website disappear from Google after a hack?

Not automatically, but Google can show a warning or index spam pages from your site, which lowers your ranking. After cleaning up, you request a new review in Search Console. The sooner you do that, the sooner it recovers.

Do I have to warn my customers if my site has been hacked?

If personal data was viewed or stolen, you may have to report it to the Dutch Data Protection Authority, and it is wise to inform the affected customers. Keep it short and factual: what happened and what they need to do themselves. If you are unsure, ask for legal or technical advice.