How do you know your website has been hacked?
The signs aren't always obvious. Look for any of these:
- Google shows "This site may be hacked" next to your listing, or browsers show a warning.
- Google Search Console's Security Issues report flags hacked content, malware or social engineering.
- Pages you didn't create appear in Google, often in another language or selling something unrelated.
- Visitors get redirected to other sites, especially on mobile or from search results.
- New admin users, changed files or unfamiliar plugins appear.
- Your host suspends the account, or your email starts bouncing as spam.
Website hacked: what to do in the first hour?
Work through these steps in order. Speed matters, but order matters more.
- Contain it. Take the site offline or show a holding page, so visitors and customers aren't harmed. Your host can help.
- Tell your host and your developer or care plan provider. They may see things you can't, such as server logs.
- Change every password from a clean device: hosting, CMS admin, database, FTP or SSH, domain registrar and the email accounts linked to them. Turn on 2-step verification wherever you can, as the NCSC advises.
- Remove any user accounts you don't recognise.
- Keep evidence before you change anything else: a copy of the hacked files and any logs.
How do you clean up a hacked website?
Once it's contained, follow these steps. Google's help for hacked sites covers the same ground in more detail.
- Use Search Console's Security Issues report to see what Google found, and which pages are affected.
- Find how the attacker got in: an outdated plugin, a weak password, a vulnerable form or a compromised account. Fix that first.
- Restore from a clean backup taken before the hack, if you have one. If not, remove the injected code, files and pages by hand.
- Update everything: the platform, plugins, themes and server software.
- Check the site thoroughly: every page, every form, and how it looks from Google's results on mobile.
- Request a review in Search Console's Security Issues report once you're sure it's clean.
Do you need to report a hacked website?
If personal data may have been accessed, such as customer details, form submissions or account logins, it may be a personal data breach. The ICO's guidance says you must report a notifiable breach within 72 hours of becoming aware of it, and tell the people affected without undue delay if there's a high risk to them. The ICO's website has a self-assessment to help you decide.
You can also report cybercrime to Action Fraud in England, Wales and Northern Ireland, or to Police Scotland in Scotland.
How do you stop it happening again?
Most hacks on small business sites come through something old: an outdated plugin, an abandoned admin account, a password reused from somewhere else. The fix is dull but effective: keep software updated, use strong unique passwords with 2-step verification, keep backups away from the live site and test them, and remove anything you don't use.
Static sites on modern hosting have far less to attack, because there's no database or admin login on the public site. That's one reason we build that way.