If your website has been hacked, what counts above all is a calm, orderly approach: taking the site offline for a while, changing passwords, restoring a clean backup and closing the underlying vulnerability.
How do you recognise a hack?
An infection is by no means always visible as a classic “hacked” message. Watch out for these signs:
Your browser or Google shows a warning that the site is unsafe.
There are strange texts, links or adverts on pages that you did not put there.
Visitors are redirected to an unknown website.
The site is suddenly much slower, or gives error messages.
Spam is being sent from your domain, or your email no longer arrives.
You can no longer log in yourself, or there are administrator accounts that you do not recognise.
What do you do straight away?
- 1Stay calm and do not delete anything yetThrowing files away in haste makes it harder to investigate the cause.
- 2Take the site offline temporarilyOr in maintenance mode. That way you protect visitors and prevent further damage to your reputation.
- 3Change all passwordsFor hosting and control panel, the CMS, FTP/SFTP, the database and the email accounts. Use new, unique passwords.
- 4Alert your hosting providerThey can often see from the log files when and by what route it happened, and can help out.
- 5First make a copy of the current situationDo that before you start cleaning up, so that you can still investigate later what happened.
Restoring the site
- 1Restore a clean backupChoose a version from before the infection. Pay attention to the date: the newest backup may already be affected. See backups explained.
- 2Scan and clean upWith WordPress or Joomla, files are often modified, or extra files are left behind. Also check for unknown administrator accounts and scheduled tasks.
- 3Update everythingThe CMS core, all themes and all extensions. Remove what you do not use.
- 4Check the result in a private windowAre there no more strange redirects, and does everything work as it should?
- 5Put the site back onlineWas there a warning in Google? Then request a review if necessary.
Find the cause
Restoring without finding the cause usually means the problem comes back. In practice, it is almost always one of these three:
An outdated extension or CMS version.
A weak or reused password.
A vulnerability in third-party software.
Not sure about the way in? Then have it looked at before you continue.
Need help with recovery?
We help with cleaning up and restoring an infected WordPress website. If your site runs on Joomla, you can also come to us for a broken Joomla website.
Are you right in the middle of it and want to act quickly? Then feel free to contact us directly via the contact page.
And afterwards?
Is the site running again? Then now is the time to prevent a repeat: keep up with updates, check backups and reduce the attack surface. Those measures are covered in preventing a hacked website.
You run structurally less risk with a site without a CMS, simply because there is far less to attack.