My website's been hacked — what to do in the first hour

If you’ve landed here because something has gone badly wrong with your website, take a breath. You’re in the right place, and you have more time than the panic is telling you.

I fix and rebuild small-business websites for a living, which means I get the “my site’s been hacked” messages fairly often. They usually arrive in a rush, at an awful hour, from someone who has never touched a line of code and now feels completely out of their depth. So let me be the calm voice for a moment: a hacked website is a solvable problem. It is stressful, but it is not a disaster you have to sort out in the next ten minutes. What matters is that you do the right things in the first hour, and avoid the tempting wrong ones.

Let’s work through it together.

First, is it actually a hack?

Not everything alarming is a break-in. Websites fail in dramatic-looking ways all the time, and a scary screen isn’t proof of anything. Before you assume the worst, it’s worth a two-minute check, because the response is very different.

Things that look frightening but usually aren’t a hack:

• An expired security certificate warning. If your browser says “Your connection is not private” or “Not secure”, that’s often just the padlock certificate (the SSL) having expired. It needs renewing, but nobody has broken in.
• A plugin or theme error. A blank white page, or a line of error text at the top of your site, is frequently a piece of software that’s fallen over after an update. Untidy, not sinister.
• The site simply being down. A server hiccup or an unpaid hosting bill can take a site offline. Again — annoying, not an attack.

Now, the signs that point to a genuine compromise:

• Your site redirects visitors somewhere else — often spam, gambling, or dodgy pharmacy pages.
• Pages have appeared that you didn’t create, full of spam text or foreign-language nonsense.
• Google or the browser shows a red “Deceptive site ahead” or “This site may harm your computer” warning.
• You’re locked out of your own admin login, or your password has stopped working.
• Your hosting company has emailed you to say they’ve suspended the site for malware or spam.

If you’re seeing one or more of those, treat it as a real hack and work through the steps below. If you’re only seeing the “scary but harmless” symptoms, you can relax considerably — that’s ordinary maintenance territory, and my guide on what website maintenance actually involves will point you the right way.

The single most important rule: don’t start deleting things

Your instinct will be to wipe it all and start fresh. Please don’t — not yet.

Here’s why. To properly fix a hacked site, someone needs to find how the attacker got in. That evidence lives in the very files, logs, and pages you’ll be tempted to bin. If you delete everything and restore an old backup, you often restore the same weakness that let them in — and you get hacked again within days. I’ll come back to this, because it’s the single biggest reason “cheap cleanups” fail.

So: hands off the delete key. We’re doing triage, not demolition.

Your first hour, in order

Work through these in sequence. Don’t skip ahead.

1. Don’t delete or “fix” anything yet. Resist the urge to remove files, reinstall, or restore a backup. You’re preserving the scene so the entry point can be found.

2. Change your passwords — from a device you trust. Use a computer or phone you’re confident is clean (not one that might be part of the problem). Change your hosting account password first, then your website admin password. If you reuse either of those passwords anywhere else — email especially — change those too. Where it’s offered, turn on two-factor authentication (the text-message or app code on login).

3. Ring or message your hosting provider. This is the step people skip, and it’s often the most useful. Your host has seen this a hundred times. Many can run a malware scan, tell you when and roughly how the site was compromised, and some will clean it as part of your plan. Tell them plainly: “I think my site has been hacked, can you help me confirm and scan it?”

4. If the site is actively harming visitors, take it offline. If your site is redirecting people to spam or triggering malware warnings, it’s doing damage every minute it’s live — to visitors and to your reputation with Google. Put it into maintenance mode (a simple “we’ll be back shortly” holding page) or ask your host to take it offline temporarily. A quiet, honest holding page is far better than a live site attacking your customers.

5. Preserve the evidence. Don’t wipe your logs, and don’t delete your existing backups even if they feel tainted. Those backups and logs are how the real cause gets diagnosed. If anything, make an extra copy of the current state and set it aside. You can always throw it away later; you can’t un-delete it.

That’s the first hour. Notice what’s not on the list: rebuilding, panicking, or paying the first “we’ll clean your site for £40” advert you find. Those come later, calmly, once you understand what you’re dealing with.

What “cleaned” actually means (and why cheap fixes fail)

This is the part I most want you to take away, because it’s where money gets wasted.

A hacked site is only genuinely clean when three things have happened:

1. The malware is removed — the bad files and injected code are gone.
2. The hole is closed — the specific weakness that let them in is found and fixed.
3. The locks are changed — every password, and any behind-the-scenes keys or secrets (things like API keys and database passwords), is rotated.

Cheap cleanups typically do only the first one. They scrub the visible malware, the site looks fine, everyone’s relieved — and because the door is still unlocked and the old keys still work, the attackers walk straight back in. That’s why people end up re-hacked “for no reason” a few days later. It was never actually secured; it was tidied.

Think of it like a burglary. Clearing up the mess isn’t the same as fixing the broken window and changing the locks. All three, or you’ll be doing it again. This is a good chunk of what my security and hardening service involves — not just removing the bad stuff, but making sure it can’t come back the same way.

How sites get hacked, in plain English

Attacks on small-business sites are rarely personal. They’re almost always automated — software roaming the internet, rattling doorknobs, looking for the easy ones. The easy ones usually come down to three things:

• Out-of-date plugins and themes. Most small sites (especially on WordPress) run on lots of little add-ons. When one has a known flaw and hasn’t been updated, it’s an open door. This is the most common cause by a distance.
• Weak or reused passwords. If “yourbusiness2019” protects your admin login, or you use the same password as a shop that got breached last year, you’re an easy target.
• “Nulled” themes and plugins. These are pirated paid tools offered free on shady sites. They very often have malware baked straight in. A free premium theme is not a bargain — it’s the bait.

None of these require you to have done anything obviously silly. They’re just the gaps that build up quietly over time — which is also the theme of my piece on the real cost of a cheap website.

Stopping it happening again

Once you’re through the emergency, prevention is genuinely straightforward:

• Keep everything updated. Plugins, themes, and the core system. Most hacks exploit flaws that were fixed months ago in an update nobody installed.
• Use strong, unique passwords and a password manager to remember them. Turn on two-factor authentication.
• Delete plugins and themes you don’t use. Every one is a potential door, even switched off. Fewer doors, fewer risks.
• Have real backups — stored somewhere separate from the site, and tested occasionally so you know they actually restore.

That’s the bulk of it. Not glamorous, but it’s what keeps sites boring and safe, which is exactly what you want a website to be.

When to get help now

Plenty of small hacks can be handled by a capable, careful owner with a patient hosting provider. But some situations call for a professional straight away — not because you can’t cope, but because the stakes are too high to learn on the job. Get help now if:

• Customer or payment data may be involved. If your site stores personal details, or handles payments, a breach can carry legal and data-protection obligations. Don’t guess your way through that.
• It’s a shop, or takes bookings or payments. E-commerce and booking sites are more complex and more valuable to attackers. The cleanup is harder to get right, and the cost of getting it wrong is real lost income.
• It keeps coming back after cleanups. If you’ve “fixed” it once or twice and it’s returned, that’s a clear sign the hole was never closed. Stop patching and get someone to find the actual entry point.

If any of those apply, that’s your cue. And if you’d simply like a second pair of eyes to tell you how bad it really is, my Free Site Check is exactly that — an honest look, no pressure.

For now, though, take the breath you skipped at the start. You’ve confirmed what you’re dealing with, you’ve changed the locks, you’ve called your host, and you haven’t deleted the evidence. That’s a genuinely good first hour. The rest is just working the problem — steadily, in order.