What to do when your website has been hacked
If you have found redirects, unfamiliar pages, malware warnings or unauthorised changes, treat the website as a security incident rather than trying random fixes on the live site.
- Protect important access credentials. Change compromised website and hosting passwords from a device you trust. If the same password has been reused elsewhere, change it there as well.
- Preserve useful evidence and backups. Do not immediately delete large groups of unfamiliar files without knowing what they are. Hosting logs, file timestamps and clean backups can help establish what changed and provide a safer recovery point.
- Limit further exposure where practical. If the site is actively redirecting visitors, serving malicious material or exposing information, restricting public access may be appropriate while the incident is investigated.
The National Cyber Security Centre recommends changing compromised credentials and restoring data only from a known good backup after an infection. For website incidents, the same principle matters: restoring an infected copy without addressing the entry point can put the problem straight back.
If the problem is active now, our emergency website fix page also explains the service available for urgent non-malware failures.
How hacked website repair goes beyond deleting malware
Our Hacked Site Rescue is currently £349 at a fixed price. The service includes a full malware scan and clean, finding and closing backdoors, security hardening after cleanup, a Google blacklist removal request where necessary and an incident report for your records.
A backdoor matters because removing only the obvious malicious file can leave another route into the website. Attackers may add new administrator access, modified application files or code designed to recreate deleted malware. The repair therefore has to address both the malicious material and the persistence mechanism that allowed access to continue.
Google recommends checking Search Console's Security Issues report when a website has been compromised. It may show sample URLs containing hacked content, malware or deceptive pages. Google also advises fixing the security issue that allowed the compromise before requesting a review, because an incomplete cleanup can result in reinfection.
WordPress sites can also contain malicious changes outside the visible page content. If your incident is specifically WordPress-related, see WordPress malware removal.
Google warnings and hacked pages in search results
A compromised website can affect more than the pages a business owner normally sees. Attackers sometimes create large numbers of injected pages, redirect search visitors or place deceptive content on URLs that are difficult to find through the site's normal navigation.
Google Search Console can help identify this because its Security Issues report records certain security problems detected by Google. Google may also display warnings when it believes a site contains malware or deceptive content. Once the website has been cleaned and the underlying security problem addressed, a review can be requested through Search Console where applicable.
Our Hacked Site Rescue includes the Google blacklist removal request. That means preparing the cleaned website for review and submitting the appropriate request. The final removal of a Google warning is controlled by Google, so no legitimate repair service can dictate the review outcome or timing.
After recovery, continued uptime and security monitoring can help identify future malware, blacklist or availability alerts. Monitoring is useful after an incident, but it does not replace keeping the site maintained and backed up.
Close the original route back into the website
Cleaning malware without considering how it arrived leaves an obvious risk of recurrence. Once malicious code and backdoors have been removed, the next job is to reduce the weaknesses that can be addressed from the website side. Hacked Site Rescue therefore includes security hardening after cleanup and comes with a 30-day re-infection guarantee.
For a WordPress site, the wider maintenance position should also be checked. WordPress core, plugins and themes need to remain current, and the PHP version underneath the site should still receive appropriate support. The NCSC specifically recommends installing CMS, theme and plugin security updates when they become available.
Backups need separate consideration. A useful recovery copy should not depend entirely on the same live environment that has just been compromised. Our website care plans include daily off-server backups, alongside routine updates, security scanning and monitoring. See website backups for the role backups play in recovery.
If personal information may have been accessed or disclosed during the compromise, the technical repair is only one part of the response. UK organisations should assess the incident under ICO personal data breach guidance. Where a breach is reportable, the ICO states that notification must be made without undue delay and, where feasible, within 72 hours of becoming aware of it.
After the website has been cleaned
The incident report supplied with Hacked Site Rescue gives you a record of the security incident and the remediation work. It can also provide useful context when deciding what should change after recovery.
Some sites only need the immediate cleanup. Others have reached the point where ongoing maintenance is the more sensible option, particularly when nobody is routinely responsible for updates, backups or monitoring. Essential Care costs £59 a month and includes weekly WordPress core, plugin and theme updates, daily off-server backups, 24/7 uptime monitoring, security scanning and hardening, and a monthly health report.
If the site is stable but you only require ongoing detection, Uptime & Security Monitoring costs £29 a month or £290 a year.
The important distinction is that hacked website repair deals with the existing compromise. Ongoing website security and maintenance reduce avoidable weaknesses and improve your ability to spot or recover from a later incident.