Finding out that your website was hacked feels awful, and the temptation is to start deleting things at once. Don't. A clear order of steps gets your site clean faster and stops the problem from coming back.

1. Confirm what you are dealing with

Signs of a hacked site include a browser warning ("Deceptive site ahead"), a Google search result with strange Japanese or pharmaceutical text, visitors being redirected to another site, new admin users you never created, or your host suspending the account. Check your own site from a private window, and from your phone on mobile data, because some malware only shows itself to visitors who arrive from a search engine.

You can run a quick outside check with our free website hack check. It looks at malware lists and for injected scripts, hidden links and spam, and it only sees what any visitor can see.

2. Contain it

  • Put the site in maintenance mode or take it offline briefly, so visitors and search engines stop seeing the infected pages.
  • Make a full backup of the hacked site (files and database) before you change anything. You may need it to find out how it happened.
  • Change every password that gives access: hosting panel, FTP and SSH, the database, the CMS admin accounts, and the email account used for resets. Do it from a computer you trust.

3. Find out what changed

Hackers rarely leave one trace. Look for:

  • Unknown admin users in your CMS. Remove them.
  • Recently modified files, especially PHP files in upload folders, which should never contain code.
  • Strange code in your theme's header.php, footer.php or functions.php, and long, unreadable strings that use eval or base64_decode.
  • Hidden backdoors: small files that give the attacker a way back in, often with random names.

If you have a clean backup from before the attack, restoring it is usually faster and safer than cleaning by hand. Restore it, then continue with the steps below, because the same hole is still open.

4. Close the hole

Most hacked sites were not targeted personally. They had an outdated plugin, theme or core version, a weak or reused password, or a vulnerable extension nobody used any more. After cleaning:

  • Update everything: the CMS, themes and plugins, and PHP itself.
  • Delete plugins and themes you don't use. Unused code is still attack surface.
  • Use strong, unique passwords and turn on two-factor authentication for admins.
  • Check file permissions and remove write access where it isn't needed.

5. Tell search engines and visitors

If Google flagged your site, open Google Search Console, look at the Security issues report, and request a review once the site is clean. If customer data may have been exposed, check what legal duties you have to inform them. That depends on where you and your customers are.

6. Make sure it stays clean

Cleaning once is not enough, because attackers often leave a backdoor and return. For the next weeks, watch the site closely: new files, new users, changed pages and unexpected scripts. This is exactly what an automated monitor is for. ServerMonitor checks your pages regularly for injected scripts, hidden links, spam keywords and listings on malware and phishing lists, and alerts you early.

Should you ask for professional help?

If the infection keeps coming back, if you handle customer payments or personal data, or if you simply don't have the time, a professional cleanup is worth the cost. Whoever does it should tell you how the attacker got in, not only remove the symptoms.

The best time to prepare for this is before it happens: keep software updated, keep recent backups outside the server, and use monitoring that tells you the same day.