Article draft
Unexpected redirects, unfamiliar administrator accounts, spam pages, browser warnings or unusual outbound email can indicate a compromised website, although other technical faults can look similar. Respond methodically. Avoid making random changes that destroy evidence or allow an attacker to remain in control.
1. Assess the impact and contact the host
If the site is actively harming visitors or sending spam, ask the hosting provider about isolating the affected account or disabling risky functionality. Preserve relevant logs and note when the issue started.
If the website processes payments, personal information or other sensitive data, follow your incident plan and obtain qualified technical and legal advice about applicable notification obligations.
If the website processes payments, personal information or other sensitive data, follow your incident plan and obtain qualified technical and legal advice about applicable notification obligations.
2. Protect accounts from a clean device
Change affected credentials using a device believed to be clean. Prioritise hosting, domain registrar, DNS, WordPress administrators, database access and any connected services. Revoke suspicious sessions and tokens where supported.
Do not send passwords or secret keys in public support requests. Use the provider’s secure support channel.
Do not send passwords or secret keys in public support requests. Use the provider’s secure support channel.
3. Investigate before restoring
Review recent file changes, administrator accounts, plugin and theme versions, access logs, scheduled tasks and outbound email activity where available. A malware scan is useful but may not identify every persistence mechanism.
Determine the likely entry point. If a vulnerable plugin or compromised account remains, restoring the site without fixing it may lead to reinfection.
Determine the likely entry point. If a vulnerable plugin or compromised account remains, restoring the site without fixing it may lead to reinfection.
4. Clean or restore safely
Use a known-clean backup if appropriate, but check the backup date and whether it predates the compromise. Restore in a controlled environment when possible and validate files, database, forms and integrations.
Update software, remove unauthorised accounts, rotate credentials and confirm that hosting and DNS settings are correct before returning the site to normal operation.
Update software, remove unauthorised accounts, rotate credentials and confirm that hosting and DNS settings are correct before returning the site to normal operation.
5. Monitor after recovery
Check search results, security warnings, redirects, new files, administrator changes and outbound email after recovery. Request a review from the relevant security or hosting provider if warnings persist.
Document what happened, how it was resolved and what controls will reduce the chance of recurrence.
Document what happened, how it was resolved and what controls will reduce the chance of recurrence.
Frequently asked questions
Should I immediately delete suspicious files?
Not without understanding their role and preserving evidence where needed. Isolate the problem and involve the host or a qualified specialist before destructive cleanup.
Can I fix a hacked website by restoring a backup?
Sometimes, but only if the backup is appropriate and the entry point is addressed. A compromised backup or unchanged vulnerability can cause reinfection.
Will Google remove malware warnings automatically?
Not necessarily immediately. After cleaning, follow the relevant search or browser security review process and verify the site is genuinely safe.
