Finding out your website has been hacked is stressful. It's also more common than most business owners expect. Here's what to do if it happens — and what to have in place beforehand so recovery is straightforward.
First steps
Don't panic. A hacked website is a problem with a solution — especially if you have recent backups.
Take the site offline if it's actively serving malicious content. If your site is showing spam, redirecting visitors, or displaying warnings in Google, getting it offline quickly prevents further damage to your reputation and your visitors.
Contact your host or web agency immediately. If you're on a managed hosting plan, this should be your first call. If you're managing your own hosting, log in to the control panel and take the site down while you assess.
Recovery with a backup
If you have a recent, clean backup, recovery is relatively straightforward. The compromised version is replaced with the backup, the entry point is identified and patched, and passwords are reset.
This is why backups matter. A recent backup turns a serious incident into a contained one.
Recovery without a backup
Without a backup, recovery means manually identifying and removing all malicious code from the site's files and database. This is time-consuming, technically involved, and not always complete — traces of a compromise can be missed and the site can be reinfected.
In the worst cases, a rebuild from scratch is the cleaner option.
After recovery
- Update all plugins, themes, and WordPress core immediately
- Change all admin passwords
- Enable two-factor authentication
- Review any user accounts for ones you don't recognise
- Check with Google Search Console for any manual actions or warnings
Preventing it from happening again
The combination of regular software updates, strong passwords, a reputable host, and active backups prevents the vast majority of attacks. Our maintenance plans cover all of this on an ongoing basis.
Get in touch with NC Digital if your site has been compromised or read about why WordPress sites get hacked in the first place.