If your website has been hacked, first take a full copy of it as it is, then change every password connected to it (hosting, website admin, database, FTP, domain), and only then start cleaning. Deleting files or restoring an old backup straight away often destroys the evidence of how they got in, and the site is reinfected within days.
In the first hour
- Copy the site and database as they are now.
- Change passwords for hosting, admin users, database and FTP, from a computer you trust.
- Check admin users and remove any you don't recognise.
- Tell your host; they may have already spotted it and can show you their logs.
- Consider maintenance mode if visitors are being redirected to scam sites.
What not to do
- Don't just restore a backup and carry on: the hole is still there.
- Don't rely on one security plugin scan; they miss things in the database and server files.
- Don't ignore it because the homepage looks fine. Hacks often only show to Google or mobile visitors.
Cleaning up properly
Find the way in (usually an outdated plugin, theme or reused password), remove malicious code from files and the database, update everything, add a firewall and two-factor login, then ask Google to review the site if it was flagged.
Need it cleaned up today? See hacked website repair.
