If your website is hacked, act in this order within 24 hours: put the site into maintenance or take it offline, change every password, tell your hosting company, restore a clean backup from before the hack, update everything, then check Google Search Console for security issues. Find how they got in, or it will happen again.
Key Takeaways
- Contain first: stop the damage spreading to visitors before trying to fix anything.
- Change all passwords, including hosting, admin, database, FTP and email, from a clean device.
- Restoring a clean backup taken before the hack is usually the fastest reliable fix.
- Update WordPress, themes and plugins, and remove anything unused, before going live again.
- Check Google Search Console for security warnings and request a review once the site is clean.
How Do You Know Your Website Was Hacked?
Common signs include strange pages or spam links you did not create, visitors being redirected to other sites, a browser or Google warning that the site is unsafe, new admin users you did not add, emails from your host about suspicious activity, or a sudden drop in traffic. Sometimes the owner only notices when a customer complains. Do not panic, and do not start deleting files at random; follow a clear order.
What Should You Do in the First 24 Hours?
| Time | Action | Who |
|---|---|---|
| Hour 0 to 1 | Put the site in maintenance mode or ask the host to take it offline; save screenshots of what you see | Owner or developer |
| Hour 1 to 2 | From a clean device, change passwords for hosting, website admin, database, FTP or SFTP, domain and email; turn on two-step login | Owner |
| Hour 2 to 3 | Contact your hosting company; ask for logs and whether other sites on the account are affected | Owner or developer |
| Hour 3 to 8 | Find the last clean backup from before the hack and restore it; if none exists, clean the files and database | Developer |
| Hour 8 to 12 | Update WordPress, themes and plugins; delete unused ones; remove unknown admin users | Developer |
| Hour 12 to 18 | Look for the entry point: outdated plugin, weak password, nulled theme, shared login | Developer |
| Hour 18 to 24 | Bring the site back online; check Search Console security issues; request a review if flagged | Owner and developer |
Example plan; a complex hack may take longer. If customer payment or personal data may have been exposed, take advice on your obligations.
Who Should You Contact?
- Your hosting company: for logs, malware scans, isolating the account and restoring server backups.
- Your developer or a maintenance provider: for cleaning, restoring and hardening the site.
- Your domain registrar: if you think the domain or DNS settings were changed.
- Your payment provider: if the checkout or payment pages may have been tampered with.
- Your customers: if their data may be affected, after taking advice on what to say.
Should You Restore a Backup or Clean the Site?
Restoring a backup from before the hack is usually faster and more reliable than finding every infected file. The catch is knowing when the hack started; restore from too late and the problem returns. If you have no clean backup, a developer must clean files and the database line by line, compare core files with fresh copies and remove hidden users and scheduled tasks. This is why regular, off-site backups matter; see our website backups guide.
What About Google Warnings?
Google Search Console alerts site owners to security and spam problems it finds. Once the site is clean, check the security issues report and request a review if your site was flagged. Warnings in search results and browsers are removed after Google confirms the site is clean, which can take some time. Make sure Search Console is set up in your name before you need it.
How Do You Stop It Happening Again?
The WordPress hardening guide's basics apply to most sites: keep everything updated, use strong unique passwords and two-step login, give each person their own account with the least access they need, use only trusted plugins and themes, disable file editing in the dashboard, and keep regular backups off the server. Never use pirated or "nulled" themes and plugins; they are a common entry point. Our security checklist lists every step.
How We Can Help
If your site has been hacked, message us on WhatsApp with what you are seeing. We restore from clean backups where available, clean the site, update and harden it, and help with Search Console reviews; emergency clean-ups are quoted after a first look. Our maintenance plan at Rs 7,200 a month includes updates, off-site backups and monitoring, which prevents most hacks in the first place. See our pricing page and the guide to getting your website on Google.
Frequently Asked Questions
How We Researched This Guide
Hardening and backup advice follows WordPress developer documentation, and Search Console alerts follow Google's help page, checked 29 October 2026. The hour-by-hour table is an illustrative plan based on how we handle clean-ups; complex cases take longer. We quote no clean-up price because it depends on the damage. Maintenance price is our own.
Sources
- WordPress Developer Resources — Hardening WordPress
- WordPress Developer Resources — WordPress backups
- Google Search Console Help — About Search Console
- OWASP — Top 10 web application security risks
- Google Search Console Help — Manage owners, users and permissions
Disclosure: Kamboh Associates sells the web development services discussed here. Other providers' prices are quoted from their own public pages on the dates shown and may have changed. We correct errors as soon as they are reported. First published ; last reviewed .
Keep Reading
Has your website been hacked?
Send us a short description of your project and we'll reply within one business day with a written scope, fixed price and timeline.