Website hacked? How to fix it, step by step

Signs your website has been hacked

You may have been hacked if you see any of these:

• a "This site may be hacked" or "Deceptive site ahead" warning in Google or the browser
• an email from Google Search Console about hacked content or malware
• spam pages in Google results when you search site:yourdomain.com (often in other languages, or about pharmaceuticals or gambling)
• visitors, especially on mobile, being redirected to other sites
• new admin users, plugins or files you didn't add
• your host suspending the site or reporting malware
• emails from your domain that you didn't send

If you see any of these, work through the steps below in order. If you have a developer or agency, call them now and share this list.

Step 1: Contain it

• Don't panic-delete files. You may destroy what you need to find the cause.
• Contact your host. Many hosts can isolate the site, scan it and help restore. Some include clean-up in their plans.
• Consider taking the site offline or showing a maintenance page if it's redirecting visitors or serving malware, to protect them.
• Take a full copy of the current files and database before changing anything, so you can investigate later.

Step 2: Change every password and remove unknown users

Assume all credentials are compromised:

• CMS admin accounts (every user, not just yours)
• hosting control panel
• FTP/SFTP and SSH
• database password (and update your site's configuration file to match)
• domain registrar and DNS provider
• any email accounts on the domain

Remove admin users you don't recognise. Turn on two-factor authentication everywhere it's available. If you use WordPress, generating new security keys in wp-config.php logs everyone out.

Step 3: Find out what was changed

You need to know the scope before you clean.

• Search Console's Security issues report lists the problems Google found, with example URLs.
• URL Inspection shows what Google sees on affected pages, which may differ from what you see (some hacks only show spam to search engines or mobile users).
• A malware scanner from your host or a reputable security plugin flags infected files.
• Recently modified files and new files in unexpected places (such as uploads folders) are common signs.
• The database: look for injected scripts in posts, pages and widget content, and for unfamiliar admin users.
• .htaccess and other server configuration files are often altered to redirect visitors.

Step 4: Restore or clean the site

Option A: Restore from a clean backup

Usually fastest, if you have a backup from before the hack.

1. Pick a backup from before the first sign of compromise. Hacks often happen days or weeks before anyone notices.
2. Restore files and database.
3. Immediately update CMS core, themes and plugins, because the restored site still has the vulnerability that let the attacker in.
4. Change passwords again after restoring.

Option B: Clean the site

If there's no clean backup:

1. Replace CMS core files with fresh copies from the official source.
2. Reinstall themes and plugins from their official sources; delete any you don't use or can't verify.
3. Remove malicious files, injected code and spam pages identified in Step 3.
4. Clean injected content from the database.
5. Scan again until clean.

Cleaning a badly compromised site is skilled work. If it's beyond you, use your host's clean-up service or a specialist; it's often cheaper than a second hack.

Step 5: Close the way in

If you skip this, it will probably happen again. The common causes are:

Then follow our website security checklist to harden the site.

Step 6: Get Google's warning removed

1. Make sure the site is fully clean, including spam pages, which should now return 404 or 410.
2. In Search Console, open Security issues, confirm you've fixed the problems, and select Request review. Describe what you found and what you fixed.
3. Google reviews the site. Reviews for hacked content typically take days; reviews for malware can be quicker.
4. Use the Removals tool for urgent spam URLs if needed, and check the Pages report as Google drops the spam URLs.

If the warning came from another service, such as an antivirus or browser blocklist, use that service's review process too.

Step 7: Tell the people who need to know

• If personal data may have been accessed (form submissions, customer accounts), take advice on your data protection obligations. In the UK and EU, some personal data breaches must be reported to the regulator within 72 hours.
• Tell staff, and customers if they may have been affected or saw warnings.