What to Do If Your Website Is Hacked: A Recovery Plan

It is a bad moment: your website is showing strange content, redirecting visitors, or Google is warning people to stay away. Do not panic, and do not make it worse. A hacked site can usually be cleaned and restored, especially if you act methodically. This guide walks through what to do.

Signs your site may be hacked

Content you did not write, such as spam pages or unfamiliar links.
Visitors redirected to strange sites, especially from search results or mobile.
Browser or Google warnings such as "This site may be harmful" or "Deceptive site ahead".
Your site suddenly disappears from search or shows odd titles in Google results, often in other languages.
Unexplained new admin users.
Sudden drops or spikes in traffic.
A very slow site, or one that crashes.
Your host suspending the account for malware or spam.
Customers reporting spam emails or strange messages from your domain.
Files changed that you did not touch.

Some symptoms only appear to certain visitors, so a site can look fine to you and still be compromised.

Step 1: Stay calm and limit the damage

Put the site into maintenance mode, or temporarily take it offline, so visitors are not exposed. Your host or developer can do this at the server level.
Do not delete everything in a hurry. You may need evidence to find how the attacker got in.
Tell the people who need to know inside your business, so nobody makes conflicting changes.

Step 2: Change every password

Assume credentials are compromised. From a clean, trusted computer, change passwords for:

The website admin and every user account.
Hosting control panel and FTP or SSH logins.
Database passwords.
Domain registrar account.
Email accounts linked to the site.
Any connected services, such as payment gateways and email marketing tools.

Use long, unique passwords from a password manager, and turn on two-factor authentication everywhere. If a computer with malware was used to log in, scan it too.

Step 3: Contact your host and developer

Hosts often have security tools, logs and backups, and can sometimes identify the entry point. Tell them what you have seen and ask what they can provide. If you have a maintenance provider, call them now. See website maintenance plans explained.

Step 4: Identify what was affected

Scan the site with a reputable malware scanner.
Compare files against a clean copy or the official software packages.
Check user accounts for any you do not recognise.
Review logs for suspicious logins and requests.
Check Google Search Console for security issues and manual actions.
Check whether customer data may have been accessed, which affects your legal duties; see Step 8.

Step 5: Clean or restore

You have two main routes.

Restore from a clean backup

If you have a backup from before the compromise, restoring is often the fastest route. But restoring alone will not stop it happening again if the original weakness remains, so patch it straight away. This is why tested, off-site backups matter; see online store security and backups.

Clean the existing site

If there is no clean backup, a professional cleans the site by removing malicious files and code, repairing the database and reinstalling the core software and plugins from trusted sources. Cleaning is detailed work; missing a single backdoor lets the attacker return.

Step 6: Close the hole

Find and fix how they got in. Typical causes:

Outdated software, themes or plugins.
Weak or reused passwords.
Abandoned plugins with known vulnerabilities.
Compromised hosting accounts.
Insecure file permissions.
Infected computers used by staff.

Then harden the site:

Update everything.
Remove unused plugins, themes and users.
Enable two-factor authentication.
Add a web application firewall.
Limit login attempts.
Restrict file editing from the admin panel.
Set up automated, off-site backups and malware monitoring.

Step 7: Clean up your reputation with search engines

If Google flagged your site:

After cleaning, check the Security Issues report in Google Search Console.
Request a review, explaining what you fixed.
Resubmit your sitemap.
Remove any spam pages and request removal of spam URLs from search results.

Warnings usually clear within days of a successful review. Rankings often recover too, but spam content that was indexed can take time to disappear. See SEO basics for small business websites for how search recovery works.

Step 8: Consider your legal duties

If personal information may have been accessed without authorisation, South African privacy law (POPIA) requires you to notify the Information Regulator and the affected people as soon as reasonably possible, unless a law enforcement body asks you to delay. Take legal advice quickly if customer data was involved. See POPIA and your business website.

If payment details were involved, tell your payment provider immediately. Stores that use hosted payment pages are less exposed; see payment gateways for South African online stores.

Step 9: Communicate sensibly

Tell customers what happened, in plain language, if their data or experience was affected.
Advise any necessary action, such as changing passwords.
Do not downplay it, and do not speculate.
Update your team on what changed.

Transparency, handled well, often protects trust more than silence.

Step 10: Learn from it

Write a short incident report: what happened, how it was found, how it was fixed and what changes will prevent a repeat. Update your maintenance routine accordingly.

Preventing the next one

Most hacks are preventable with routine care.

Update software promptly.
Use quality hosting with security features.
Choose well-maintained plugins and themes, and remove the rest.
Use strong passwords and two-factor authentication.
Limit admin access.
Keep automated, tested, off-site backups.
Monitor uptime and security alerts.
Make sure you own and control all accounts. See domains, hosting and business email explained.

Quick emergency checklist

Put the site in maintenance mode
Change all passwords from a clean device
Contact host and developer
Scan and identify the damage
Restore from a clean backup or have the site professionally cleaned
Fix the vulnerability
Request a Google review if flagged
Assess privacy and notification duties
Communicate, then improve your defences

Prevention costs far less than recovery. If your site is business-critical, treat security as an ongoing responsibility, not a one-off task.