My website was hacked: what to do in the first hour
Your site shows spam, sends visitors somewhere else, or Google warns people away from it. This is a checklist for the next hour, in the order that limits the damage. No technical background needed.
Do not delete anything yet. Call or write to your host and ask them to confirm the hack and, if visitors are being harmed, take the site offline. From a computer you trust, change every password connected to the site. Copy the hacked site as evidence. Then restore a clean backup from before the hack or have the site cleaned, update everything, and ask Google to review it. If customer data may be exposed, the GDPR clock of 72 hours is already running.
Send me the address and what you see. I will tell you what has most likely happened and what to do next. Free, no sales call.
Signs that it really is a hack
- Spam, pharmacy or casino text on your pages or in your Google results.
- Visitors sent to another site, often only from Google or only on phones.
- A browser or Google warning such as "This site may be hacked" or "Deceptive site ahead".
- Admin users you did not create, or you can no longer log in.
- Your host suspended the account, or your email suddenly lands in spam.
If you use Google Search Console, its Security issues report shows what Google has found. A site that is merely slow or down is not necessarily hacked. Your host can usually tell the difference.
The first hour, in order
- Stay calm and write down what you see.Screenshots, the time you noticed, and anything unusual that happened before. You will need it for your host, an insurer or a report.
- Contact your hosting provider.Many hosts have a security team, can confirm a hack, and can take the site offline or into maintenance mode so it stops harming visitors.
- Change the passwords, from a clean computer.Hosting account, every website admin, FTP or SFTP, the database, and the email accounts on the domain. Turn on two-factor login where it is offered. If your own computer may be infected, use another one.
- Keep a copy of the hacked site.Download the files and the database as they are now, or ask your host to. Cleaning destroys the evidence of how the attacker got in.
- Restore a clean backup or have it cleaned.Only a backup from before the hack helps. Without one, the site has to be cleaned file by file, which is work for a professional.
- Update everything.WordPress or your CMS, every plugin and theme, and the PHP version underneath. Remove plugins you do not use. An outdated plugin is the most common way in.
- Ask Google to take the warning down.Once the site is clean, use Request review in the Security issues report in Search Console.
If customer data may be exposed
A web shop, booking form or member area holds personal data. Under Article 33 of the GDPR, the business running the site must notify its data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to people. In Denmark that is Datatilsynet, in Germany the data protection authority of your federal state. This is not legal advice, so involve your lawyer if you have one.
Why sites get hacked again
Restoring a backup without closing the hole brings the attacker back, often within days. The usual holes are an outdated plugin, a reused or leaked password, or old server software such as an unpatched PHP version. On your own VPS or server, nobody patches the system unless you or your developer do. That is what Wardio takes over: patching, monitoring for changed files, and backups we test by restoring them. See backups that actually restore and updating PHP.
Gotchas
- The hack may only show to some visitors. Many redirects only trigger for visitors arriving from Google or on phones, so the site looks fine when you type the address yourself. Check from your phone via a Google search.
- Deleting the infected files is not enough. Attackers usually leave a hidden back door, such as a fake admin user or an extra file. Without updating and changing passwords, the site will be reinfected.
- Do not log in from an infected computer. If malware on your own PC stole the password, a new password typed on the same PC is stolen again.
How this was checked. On 23 October 2026 we checked the steps against WordPress's official "My site was hacked" FAQ and Google's documentation for the Security issues report and review requests, and the reporting rule against the text of Article 33 of the GDPR. This page gives general guidance, not legal advice.
Sources
- FAQ My site was hacked, WordPress documentation
- Security issues report, Search Console Help
- Security issues and hacked sites, Google Search Central
- Art. 33 GDPR: Notification of a personal data breach to the supervisory authority
Questions
What should I do first if my website was hacked?
Stay calm and do not delete anything yet. Contact your hosting provider, who can often confirm a hack and take the site offline. From a computer you trust, change the passwords for your hosting account, every website admin account, FTP or SFTP, the database and the email accounts on that domain. Then take a copy of the hacked site as evidence before anyone starts cleaning.
How do I know if my website has been hacked?
Common signs are pages or search results showing spam or foreign-language text, visitors being redirected to other sites, a "This site may be hacked" or "Deceptive site ahead" warning from Google or the browser, new admin users you did not create, your host suspending the account, or your email suddenly landing in spam. Google Search Console has a Security issues report that shows what Google has detected.
Do I have to report a hacked website?
If personal data such as customer names, emails, addresses or orders may have been accessed, the GDPR requires the business running the site to notify its data protection authority without undue delay and where feasible within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. In Denmark that is Datatilsynet; in Germany it is the data protection authority of your federal state. This is not legal advice.
Can I just restore a backup?
Only a backup from before the hack, and only together with changed passwords and updated software. Otherwise the attacker comes back the same way, often within days. Restoring also removes evidence, so copy the hacked state first if you may need to report the breach or find out how it happened.
Send me the address and what happened. You get a plain answer on what to do, and if you want, we clean it up and keep it patched. Pricing.