Website hacked? What to do in the first hour
Short answer: don't panic and don't start deleting things. Change your passwords from a clean device, take a copy of the site as it is, tell your host, and then clean it up properly, including finding how the attacker got in.
Signs your site has been hacked
- Visitors are redirected to spam or scam sites (often only on mobile, or only from Google).
- Google shows "This site may be hacked" or Chrome shows a red warning.
- Unknown admin users, pages or files appear.
- Your host suspends the site or reports spam being sent from it.
The first hour, step by step
- Use a clean device. If your computer might be infected, changing passwords on it can hand the new ones straight over.
- Change the important passwords: hosting control panel, WordPress admins, FTP/SFTP, the database, and the email account linked to them. Turn on two-factor sign-in wherever it's offered.
- Take a backup of the site as it is now. It feels backwards, but it's evidence. It's how you work out what happened and what was changed.
- Tell your host. They may already know, may have logs, and may need to contain it to protect other sites.
- Don't just restore an old backup and move on. If you don't close the hole the attacker used, they'll be back, often within days.
- Think about data. If customer information could have been accessed, you may have obligations under the Notifiable Data Breaches scheme. The OAIC website explains when.
Then, clean it up properly
A proper cleanup has four parts: find how they got in, remove everything they left (including hidden backdoors), close the weakness, and ask Google to remove any warnings. Skipping the first part is the most common reason sites get reinfected.
If you want it handled, I do WordPress malware removal and hacked site repair at a fixed price, starting within one business day, with a plain-English report at the end.
Stopping it happening again
Keep everything updated, remove plugins you don't use, use strong unique passwords with two-factor sign-in, and keep backups somewhere separate from the site. Or, for a brochure site, consider whether you need WordPress at all: a static website has almost nothing to attack. See the October 2026 PHP flaw for why.