You open your company website on your phone and it sends you to a betting page. Or a client writes to say their browser showed a red warning before letting them in. At that moment most people act fast and in the wrong direction: they delete files at random, or put the site back online exactly as it was.
This is the order we work in when a hacked website comes to us, and you can follow it with your own team.
What should you do in the first hour?
Isolate the site first. Put up a maintenance page, or ask your host to suspend it temporarily, so your visitors don't get infected and the damage doesn't spread. Then take a copy of the current state as it is, files and database included. You will need it to work out how the attacker got in, so don't start by deleting anything.
Next, change every password connected to the site: cPanel, FTP accounts, the database, the site's admin panel and the administrator's email. Do this from a clean device, because some hacks start on an employee's computer where a password was stolen.
- IsolateMaintenance page or temporary suspension
- DocumentA copy of the infected state before deleting anything
- PasswordsChange them all from a clean device
- RestoreFrom a clean backup older than the hack
- Close the holeUpdate, remove what you don't need, review permissions
- ReviewAsk Search Console to lift the warning
Why is restoring better than cleaning by hand?
Whoever gets into a site usually leaves more than one trace: a small PHP file among the theme files, a new admin user in the database, or a scheduled task that puts the malicious files back every night. Manual cleanup misses some of these, and the hack comes back a week later.
So we look for the last clean backup, meaning one older than the date of the hack, and restore it in full. Then we carry over by hand whatever changed since, such as new orders or articles, after checking it. This is where a daily backup stored off the server pays for itself, and it is one of the questions we suggest asking in how to choose web hosting.
What if you don't have a clean backup?
Then you clean the site by hand, carefully and in order. Start by downloading fresh copies of the same platform and of every plugin and theme from their official sources, and replace all your files with them. Then bring back only the content you uploaded yourself, such as images, after checking it.
After that, open the database and look for admin users you don't recognize and for scripts slipped into posts and settings. Check the scheduled tasks in your hosting panel, and files like .htaccess that attackers use for redirects. The scanners some hosts provide, or well-known security plugins, help you find suspicious files, though they won't find everything.
This takes longer than a restore and is less certain. That is why the first thing we do after rescuing a site with no backups is set up a daily backup off the server, as described in backing up your website and email.
How did the attacker get in?
On WordPress sites, most cases we see come from an outdated plugin or theme, or a plugin copied from an unofficial source. On other sites the cause is a weak or reused password, a file upload form that doesn't check file types, or an old PHP version.
Server access logs reveal a lot: repeated requests to one particular file, or a successful admin login from a country where you don't operate. Don't treat the problem as closed until you know the hole, because a restore on its own puts you back on the same site with the same weakness.
How do you get a Google warning removed?
Open Search Console and go to Security issues. You will see the type of problem and examples of affected pages. Once the fix is complete, click Request review and write a short account of what you did: what you found, how you removed it and how you closed the hole. Before you send the request, check that the listed pages are gone or clean.
If the attacker created thousands of spam pages, make them return a 410 or 404 code. Don't redirect them to the home page.
Should you tell customers your website was hacked?
If the site holds customer data, such as accounts, orders or contact forms, assume someone else may have seen it until you can show otherwise. Data protection laws in your country may also require you to notify an authority or the people affected within a set time.
These rules differ between Jordan, Saudi Arabia and other countries, and they depend on the type of data, so talk to a legal advisor in the first few days. In practice, a short, honest message to customers asking them to change their passwords and warning them about scam emails that may arrive in your name is better than letting them find out from someone else.
How do you stop it from happening again?
The cheapest measures have the biggest effect. Update the platform and plugins every week, and delete any plugin you don't use. Turn on two-step verification for the admin panel. Give each employee an account in their own name with only the permissions their work needs. And run backups daily, with a copy off the server.
Some companies only need a brochure site and change its content a few times a year. For them we sometimes suggest a static site with no admin panel and no database, which leaves very little to attack. That is how we built this site.
If your website is hacked right now, get in touch or message us on WhatsApp, and we will start by isolating it and assessing the damage. After that we can take over security, updates and backups as part of our hosting and server service. For a new website that is harder to break into, read about our web design and development service.
Questions our partners ask
How do I know my website has been hacked?
Common signs: visitors get redirected to other sites, pages or links you never added appear in search results, the browser or Search Console shows a warning, the site suddenly slows down, or your host tells you about malicious files or spam being sent from your account.
Is deleting the infected files enough?
Rarely. Attackers usually leave a backdoor in another file or an extra user in the database. The safer route is to restore a clean backup from before the hack, then close the hole they came in through.
How long does it take to remove a Google warning?
After the fix and a review request in Search Console, the time varies from case to case and can be several days. Make sure the cleanup is complete before you ask, because a rejected review delays things further.
Written by the Visual Innovate team, the people who build, host and follow up systems, websites and apps for our clients in Jordan, Saudi Arabia, Oman and Egypt.
