Website Hacked? The First 5 Things to Do

Strange redirects, pages you did not create, a red warning in Google: a hacked site is stressful, but panic makes it worse. Here is the order of operations I use when a client calls with this.

The first hour: contain

• 1. Change every password: hosting panel, admin users, database, FTP/SSH, and the email tied to the accounts
• 2. Put the site in maintenance mode so visitors are not served malware
• 3. Take a full backup of the hacked state before touching anything, you will need it to find the entry point

# Quick containment on a Linux server
# 1. Take the snapshot first
tar -czf /root/hacked-snapshot-$(date +%F).tar.gz /var/www/yoursite

# 2. Check for recently modified files (common entry evidence)
find /var/www/yoursite -type f -mtime -7 -name "*.php" | head -50

# 3. Look for suspicious admin users in the database
SELECT user_login, user_registered FROM wp_users ORDER BY user_registered DESC LIMIT 10;

Recover

Restore the newest clean backup from before the hack, then immediately update everything: CMS core, plugins, themes, and server packages. Restoring without updating just reopens the same door.

Find the entry point

Otherwise the attacker returns next week. In practice it is almost always one of: an outdated plugin with a public exploit, a weak or reused admin password, or a credential leaked from another breach. The modified-files listing and access logs from your snapshot usually show which.

Clean up with Google

If Google flagged the site, open Search Console, go to Security Issues, and request a review after the cleanup. The warning is usually removed within a few days.

Prevention is boring and cheap

• Automatic updates for CMS and plugins, remove plugins you do not use
• Strong unique passwords plus two-factor login on hosting and admin accounts
• Automatic offsite backups, tested by actually restoring one
• A web application firewall (Cloudflare free tier already helps)

Recovery costs a weekend and client trust. Prevention costs almost nothing. Choose boring.