You are having your morning coffee when a customer calls: "I went to your website and something strange came up. It sent me to another site." You check, and sure enough there are pages you have never seen, ads in a foreign language, or a completely different home page. Your stomach drops.
Let me say this first: it is not your fault, and it happens to far more people than you would think. A shop with a weak lock gets burgled, and that says nothing about the shopkeeper. If you are thinking "my website was hacked", the first thing you need is to stay calm and work through things in order. In this article I explain what to do in the first 24 hours, what to hand over to a specialist, and what to watch for so it doesn't happen again.
Has your site really been attacked? The signs
Not every odd screen is an attack. Be suspicious if several of these apply:
- There are pages, posts or links on your site that you did not write.
- Visitors are redirected to another site, especially people on mobile phones.
- Your browser or Google shows a warning such as "this site may be harmful".
- The site suddenly became very slow, or your hosting company (the firm you rent the space for your website from) mentions unusual activity.
- Your admin password stops working and you did not change it.
- When you search for your business name, the description shows unrelated foreign words.
Even if you are not sure, the steps below do no harm. A false alarm is better than missing a real attack.
The first hour: stay calm and collect evidence
Many people try to delete everything straight away. Hold back, because a specialist needs the traces to work out what happened.
- Take screenshots. Capture the strange pages, warnings and redirects, with the date.
- Do not poke around in the site yourself. Deleting files or changing settings you don't understand can make things worse.
- Tell the person who built or maintains the site. If that person disappeared a year ago, the closing section of this article explains who can help.
- Check your own computer too. Sometimes the problem is not the site but the device where the admin password was stolen. A virus scan is a good idea.
Change the passwords
Attackers often get in with a weak or leaked password. So renew these:
- The password for your site's admin area, and for everyone with an account there.
- Your hosting account and the account where you registered your domain name.
- Any email accounts connected to the site.
New passwords should be long, different for every service, and not similar to old ones. A password manager is far safer than memory. Make sure the computer you use is clean, otherwise the new passwords can be stolen too.
Call your hosting company
The company that hosts your site is your most important partner here. Ask them:
- Did they find anything harmful on my site?
- When does the attack seem to have started?
- Do they have a clean backup, and from which date?
- Should the site be taken offline or put behind a maintenance page for now?
Showing a short maintenance page stops visitors from running into harmful content. A brief "we are under maintenance" screen is much better than sending customers to an infected page.
What does restoring from a backup mean?
A backup is a healthy snapshot of your site from a particular day. If a clean backup from before the attack exists, the site can be rolled back to that day. But there are two traps:
- The backup may be infected too. If the attacker has been inside for weeks, the recent backups are dirty. A specialist decides which date is clean.
- If the door stays open, it happens again. Restoring a backup does not close the route the attacker used. If updates are not applied and passwords are not changed first, the site can be infected again within days.
This step should be done by someone with technical knowledge. You only need to ask: is there a clean backup, from which date, and who will close the gap after the restore?
The Google warning and telling your customers
During an attack Google may have flagged your site as harmful. Once the site is cleaned, the warning is removed by asking Google to review it again. A specialist should do this, and the timing depends on Google, so I can't promise a number of days. In the meantime, assume people who see the warning won't enter your site, and stay in touch with customers through other channels.
What you tell customers matters too. Keep it simple and honest:
- We had a technical problem on our website and are working on it.
- You can reach us by phone or on our social media in the meantime.
- Please don't click links that come from strange pages on the site.
If your site stores customer records, forms or booking details, whether personal data was exposed is a separate question. Your obligations in that case should be checked with a lawyer or your data protection authority; I can't give a ruling here.
Preventing it from happening again
If an attack happened once, it will happen again unless the hole is closed. Go through these with your specialist:
| Measure | Why it matters |
|---|---|
| Regular updates | Closes known weaknesses in old software |
| Strong, different passwords | Makes guessing a way in harder |
| Regular backups kept elsewhere | Gives you a clean point to return to |
| Removing unused plugins | Fewer doors to get in through |
| Fewer admin accounts | Fewer accounts that can be stolen |
| Security scans | Problems are spotted before they grow |
No measure gives complete security. The aim is to stop you being an easy target.
Frequently asked questions
Can I clean the site myself?
On a small site it is tempting, but it is very easy to leave remnants behind. If harmful code stays hidden in a corner, the site gets infected again. I recommend getting specialist help.
Does being hacked hurt my Google ranking?
It can. Harmful content or a warning can reduce your visibility. Recovery is possible after cleaning and a new review, but I can't tell you how long it will take or what the result will be.
Should I try to find the attacker and report them?
Keep the evidence. Whether to take legal steps is something to decide with a lawyer; it wouldn't be right for me to give a general ruling.
Conclusion
An attack makes for a bad morning, but if you go step by step you will recover: collect evidence, renew the passwords, talk to your hosting company, ask about a clean backup, and be honest with customers. Leave the technical cleanup to a specialist. If your site's foundation is old and you keep running into trouble, it can make more sense to rebuild on a safer base than to keep patching. If you would like to look at that together, you can write to me through my website redesign page.