What to Do If Your Website Gets Hacked

Nordlyte Web Studio · Security Guide · 6 min read

Finding out your website has been hacked is stressful, but panicking rarely helps. If you're thinking "my website is hacked, what do I do now," here's the answer: a clear, calm walkthrough of what to check, how to fix it fast, and how to make sure it doesn't happen again.

Signs your site may have been hacked

• Unfamiliar pages, links, or redirects you didn't create
• A Google warning ("this site may be hacked") in search results
• Your hosting provider flags unusual activity or suspends your account
• Visitors report strange pop-ups or being redirected elsewhere
• Login credentials that suddenly stop working
• Admin users you don't recognise
• Spam pages, such as pharmacy or gambling content, showing up in Google results for your site
• A sudden, unexplained drop in traffic

Immediate steps to take

1 Don't panic — but act quickly

The longer a compromised site stays live, the more damage it can do to your reputation and search rankings. Move through the next steps promptly, but methodically.

2 Contact your hosting provider

Tell your host straight away. Many hosts can scan the account, show what was changed, and help you restore a backup. If they've already suspended the site, ask what they need from you to bring it back.

3 Change your passwords from a device you trust

Update your hosting account, FTP, database and connected email passwords right away, and assume all of them may be compromised, not just one. Change your website admin passwords too, but plan to reset them again after you restore a backup, because a restore can bring the old passwords back.

4 Take the site offline temporarily if needed

If the hack is actively harming visitors (malware, redirects, phishing content), it's often safer to put the site into maintenance mode or take it offline until it's cleaned, rather than leave it live. Google's own advice for hacked sites is to find and clean the compromised pages and secure the site before bringing it back online.

5 Restore from a clean backup

If you have a recent, clean backup from before the hack, restoring it is usually the fastest way back to normal. Afterwards, reset your website admin passwords again, and check for admin users or files you don't recognise. Restoring alone doesn't fix the vulnerability that let the hack happen.

6 Identify and close the vulnerability

Common causes include outdated plugins, weak passwords, or an unpatched theme. Update everything to the latest version, remove any plugins or tools you no longer use, and delete admin accounts you don't recognise. Google warns that if you don't fix the problem that allowed the infection, your site is likely to be reinfected.

7 Request a review if Google flagged you

If your site shows a security warning, open the Security Issues report in Google Search Console and choose Request a review once your whole site is clean and secure. Briefly describe what you fixed. Google says reviews for malware take a few days, while reviews for sites hacked with spam can take up to several weeks.

If customer data may have been exposed

If your site holds customer details, such as orders, accounts or contact form submissions, tell the people affected as soon as you can, and check whether the privacy rules where you operate require you to report the breach.

The quick fix, if you're short on time

If you just need the fastest path to fixing a hacked website: contact your host, change your hosting, FTP and email passwords, restore your most recent clean backup, then reset your website admin passwords again. Update everything (plugins, themes, core software), remove unused plugins and unknown admin users, and request a Google review if you've been flagged. That order matters: restoring a backup without patching the vulnerability just invites the same hack again.

How to prevent it from happening again

• Keep your platform, plugins, and themes updated — see our maintenance guide
• Use strong, unique passwords and enable two-factor authentication where available
• Keep regular, automated backups so recovery is fast if something goes wrong
• Limit the number of admin accounts and remove unused ones
• Store backups away from the server they protect, so a hack can't take both
• Add a firewall or login-attempt limits, through your host or a security plugin
• Use a reputable, security-conscious hosting provider — our hosting and domain guide explains what to look for

How our maintenance plans handle hacks

If your site is on one of our maintenance plans: on Essential, we respond within 1 working day and restore from the latest backup, which is included, while deeper malware cleanup is quoted separately. On Growth, restore and cleanup are included, up to 3 hours of work per incident, with a response the same working day. If your site was already hacked before you joined, the cleanup is a one-time job quoted separately, and the plan starts once the site is clean.

Should I hire someone to handle this?

If you're not comfortable diagnosing and fixing the issue yourself, it's worth getting a developer involved quickly — the cost of professional cleanup is usually far less than the cost of prolonged downtime or lost customer trust. You can request a one-off fix quote from us without taking a monthly plan.