Hacked Website or «This Site May Be Hacked»: What to Do Right Now

You almost always find out the worst way: a customer calls saying Google shows «This site may be hacked», someone's antivirus blocks your page, or your site suddenly has product pages you never sold, in languages you don't speak. The first reaction is panic; the second should be method. This is the method.

First, triage: is it actually compromised?

Three quick checks, in this order:

1. Search Console. If your site is registered in Google Search Console (it should be), open the security issues section — that is where Google tells you exactly what it found and where. Never registered it? Do it now: it is free and it is the official channel for recovering your reputation after the clean-up.
2. Search Google for site:yourdomain.com. Pages in the results you don't recognise — pharma, betting, text in another language — are the classic symptom of injected spam.
3. Open the site in a private window and on another device. Some attacks only show themselves to visitors arriving from Google, hiding from the owner who types the address directly.

The emergency plan, in the right order

1. Contain before you clean. Ask your host to put the site in maintenance mode or restrict access. A compromised site left online keeps infecting visitors and digging its Google reputation deeper by the hour.

2. Rotate every key. Hosting, site admin, database, FTP and the associated email — all of them, from a computer you trust. Turn on two-factor authentication wherever it exists. If the way in was a stolen password, cleaning without rotating keys is mopping with the tap open.

3. Restore from a clean backup — or clean properly. The safest path is restoring a backup from before the breach and immediately fixing the hole that allowed it (step 4). Without a reliable backup, a manual clean has to cover modified files, unknown admin users, scheduled tasks and injected code — work for someone who knows what to look for. This is a legitimate moment to pay a professional; it is cheap next to weeks of a flagged site.

4. Close the door. Most SME site breaches come through three places: outdated plugins and themes (reason number one on WordPress — we've explained why "free" demands upkeep), weak or reused passwords, and contaminated shared hosting. Update everything, remove what you don't use, and confirm your site's software version is still supported.

5. Request Google's review. With the site clean, submit a review request in Search Console. The red warning does not fall off by itself — it falls when Google re-checks and confirms the clean-up. The same goes for antivirus blocklists, which generally follow Google's verdict within days.

6. Assess your data obligations. If the site stores customers' personal data (forms, orders, accounts) and there are signs that data was accessed, the GDPR may require notifying the authority within tight deadlines. Our GDPR guide for websites covers the essentials — and when in doubt, talk to your legal adviser.

After the fire: the insurance

The difference between businesses this happens to once and businesses it happens to yearly is four boring habits:

• Automatic backups, stored away from the hosting, tested now and then — a backup you have never tried to restore is a hope, not a plan;
• Updates applied in weeks, not years — yourself, or through a maintenance contract that does it for you;
• Minimal access: each person with their own account, nobody with more permissions than they need, ex-staff accounts removed the day they leave;
• Monitoring: Search Console configured, and someone who actually reads the alerts.

One structural note, without tribalism: sites built on dozens of third-party plugins have, by simple arithmetic, more doors to watch. It is one reason — among others — why the sites we build carry the minimum of third-party moving parts: fewer doors, fewer guards, fewer scares.

If your site has been compromised and the clean-up looks bigger than your tools, describe the situation in our estimate form — we will tell you frankly whether it is a case for cleaning, restoring, or taking the chance to rebuild on solid foundations.