Hacked website: containment, recovery and next steps

Pages you did not create, unexpected redirects or malware warnings warrant investigation. A single warning does not explain the full cause. Avoid installing multiple tools and deleting files before preserving the evidence needed to understand what happened.

Contain the issue and keep evidence

Contact hosting support and restrict affected functions where needed to protect visitors. Record times, addresses and messages. Ask for relevant logs to be retained. A copy of the compromised state can support investigation, but is not a clean backup for restoring service.

If the site handles orders or bookings, agree how to communicate with customers during the intervention. Do not continue collecting sensitive information through an area known to be compromised.

Access review is part of recovery

From a trusted device, review accounts, sessions, permissions and hosting, domain and email access. Replace exposed credentials in coordination with remediation to avoid renewed exposure or accidental lockout. Use additional authentication where available.

The WordPress hardening documentation addresses risk reduction. No configuration eliminates every possibility of attack.

Recovery is more than restoring a copy

An earlier backup may be compromised or lack recent orders. Assess its date, verify contents and address the original cause. Vulnerable components, unwanted accounts and persistence mechanisms require investigation. Without a reliable backup, cleaning may need specialist work.

Our backup restoration guide helps frame the questions. Do not delete recent data without agreeing how it will be preserved.

After remediation

Check site functions, restrict unnecessary access and define monitoring. If Search Console reports security issues, follow its review process after correcting the identified problems. Other blocklist providers may have separate processes; there is no promise that every warning disappears within a fixed period.

Where personal-data access may have occurred, involve the person responsible for data protection to assess applicable obligations. Technical diagnosis does not replace that assessment.

When requesting help, share the warning, affected addresses and starting time. Do not send passwords or database files through the form. We assess whether we can take on the work or specialist assistance is required.

Request an assessment of your case

Our support starts from €10 per hour of work. Suggest your hours, choose “I cannot estimate” or propose what you can spend. The request does not commission work or confirm a quote: we agree scope and price first. Request support or explore website maintenance.