Skip to content
MaaSec
Free guide

My website was hacked: what to do now

Finding out your website was hacked is stressful, especially when it's your shop window, your booking system or your organisation's main way of reaching people. Signs include strange redirects, pages you didn't create, spam in Google results under your name, a warning from Google or your browser, or a message from your hosting company.

Work through the steps below in order. Rushing to delete things can destroy the clues you need to stop the same attacker getting back in.

Written and reviewed by MaaSec volunteers · Last updated 1 November 2026

Website hacked: what to do in the first hour

  1. 1Put the site in maintenance mode or take it offline. This protects your visitors from malware or scam pages while you work. Many CMSs and hosting control panels have a maintenance switch; your host can also do it for you.
  2. 2Contact your hosting company. Tell them what you see. They can often confirm the hack, show access logs, and tell you whether other sites on your account are affected.
  3. 3Make a copy of the hacked site before you change anything. Download the files and a database export and keep them separate. It's evidence, and it helps you find how the attacker got in.

How to fix a hacked website, step by step

  1. 1Change every password connected to the site: hosting control panel, CMS admin accounts, FTP or SFTP, the database, and the email accounts used to manage the site. Use new, unique passwords and turn on two-factor authentication wherever it's offered.
  2. 2Restore a clean backup from before the hack, if you have one. Check its date against the first signs of trouble; attackers are sometimes inside for weeks before anything visible happens.
  3. 3Update everything: the CMS, every plugin, every theme, and anything else installed on the server. Outdated software is the most common way in.
  4. 4Remove what you don't recognise: unknown admin users, plugins, themes, files and scheduled tasks (cron jobs). Attackers often add a hidden admin account or a small "backdoor" file to get back in later.
  5. 5Check again for malware. Compare files with clean copies, look for recently changed files, and check the .htaccess file (on Apache servers) for redirect rules you didn't add. Our guide on how to check your website for malware explains the tools.
  6. 6Bring the site back online only when you're confident it's clean, then watch it closely for a few weeks.

If you don't have a clean backup, or the site is complex, this is the moment to bring in your web developer or a security company. Restoring from a backup without fixing the original hole usually means being hacked again.

WordPress hacked: what to do

WordPress powers a large share of small-business websites, so it's targeted a lot. On top of the steps above:

  • Reinstall WordPress core files from the official source. If you have WP-CLI, wp core verify-checksums shows which core files were changed.
  • Delete plugins and themes you don't use, and reinstall the ones you need from their official source rather than restoring possibly infected copies.
  • Check the list of users for administrators you don't know, and remove them.
  • Replace the security keys and salts in wp-config.php. This logs everyone out, including the attacker.
  • Look for .php files in the uploads folder. That folder should normally only contain images and documents.

Hacked website recovery: removing Google's warning

If Google flagged your site, visitors may see a red "deceptive site" or "this site may be hacked" warning. After cleaning up:

  1. 1Open Google Search Console (add and verify your site if you haven't already) and check the Security issues report.
  2. 2Fix every issue listed, then click Request review and describe what you cleaned up.
  3. 3Check your site's status at Google Safe Browsing. Reviews typically take from a day to a few weeks.

Find the hole: how did they get in?

Cleaning up without finding the way in is the most common reason sites get hacked again within weeks. The usual causes are an outdated plugin or theme, a reused or weak password on an admin or hosting account, an old account nobody removed, or a vulnerable contact form or upload feature.

Your hosting logs and the copy you made in the first hour can show which files changed first and from where. A penetration test looks at the cleaned-up site the way an attacker would, to find weaknesses that are still open.

How to stop your website being hacked again

  • Turn on automatic updates for your CMS, plugins and themes, or check for updates every month.
  • Keep automatic backups, with at least one copy stored away from your hosting account, and test that you can restore them.
  • Use unique passwords and two-factor authentication for every admin, hosting and FTP account.
  • Give admin rights only to people who need them, and remove accounts when people leave.
  • Remove plugins, themes and old copies of the site you no longer use.