My website was hacked. What should I do first?

My website was hacked: what should I do? Ask your host to take the site offline or put up a holding page, then change every password tied to it (hosting, website admin, FTP, database, domain registrar and the email account those logins reset to). Next, clean the site or restore a backup made before the hack, close the hole the attacker used, and ask Google to review it in Search Console. If you run Google Ads, expect ads that point at the site to be disapproved until the clean-up is done.

Owners ask this the moment their site starts redirecting to spam or showing a red warning. One r/webhosting thread from an owner asking how to tackle a hacked website has more than 40 comments, and Google suggests follow-on searches such as “my website has been hacked and redirected” and “my wordpress site keeps getting hacked”. The steps below come from Google’s own help for hacked sites, WordPress.org’s recovery guide and Google Ads policy, put in the order a business owner would follow them.

How do I know if my website has been hacked?

The surest sign is a warning from Google: a message in Search Console, a “This site may be hacked” note under your listing in search results, or a red browser page saying the site may harm visitors. Google’s guide How do I know if my site was hacked? also lists warnings you only spot if you look: pages you never made showing up when you search site:yourdomain.com, and spam that hackers show to Google while you see a normal page (called cloaking).

Google’s malware guide separates the two search labels. “This site may harm your computer” means Google found malware. “This site may be hacked” means the site is serving spam.

Google’s FAQ for hacked sites adds two more signs: odd traffic spikes from searches that have nothing to do with your business, and visitors telling you their antivirus flagged your site. It also explains why you may not see the warning your customers see: Safe Browsing warnings depend on the visitor’s browsing context.

What should I do first if my website was hacked?

Get the site out of harm’s way, then lock the doors, in that order. Each step here comes from Google’s quarantine guide or WordPress.org’s FAQ My site was hacked.

1. Call your hosting company. Tell them the site is compromised. On shared hosting the attack can reach other sites on the same server, and the host can often switch the site to a holding page for you.
2. Take the site offline properly. Google says a 503 “temporarily unavailable” response should come from outside the infected site, for example a holding page your host serves. Blocking Google in robots.txt doesn’t count, because it only stops crawlers and real visitors can still reach the bad pages.
3. Write down what you saw. Note what happened, when you noticed it (with the time zone) and anything that changed recently, such as a new plugin or theme edit. WordPress.org calls this the baseline for your incident report, and whoever cleans the site will ask for it.
4. Remove accounts you don’t recognise. Note the usernames first, then delete them.
5. Change every password. That means hosting control panel, website admin, FTP or SFTP, database, domain registrar and the email account linked to them. Run a virus scan on the computer you use to log in before you do it, because WordPress.org notes that infections often start on the owner’s own machine.
6. Take a copy of the hacked site. Keep it even though it’s infected. It shows the cleaner what changed, and it’s your fallback if the clean-up goes wrong.

Don’t rush to delete the whole site. You lose the evidence of how the attacker got in, and that’s the part you need to fix.

Who is responsible for fixing a hacked website: my host, my web designer or me?

Usually you are, unless a contract says otherwise. WordPress’s own hardening guide puts it plainly: hosts look after the server, and the security of the website running on it is the site owner’s responsibility. In practice the work is shared, and the split depends on what you pay for.

If the answer to that last question is no, sort it out now. Our guide on what to do when your web designer won’t give you access covers how to get those logins back. When you hire someone next, put security updates and backups in writing; it’s one of the questions to ask when hiring a web designer.

Can a hacked website be recovered?

Yes, almost always. How easy it is depends on your backups. Google’s clean and maintain guide sets out three routes, and the first thing to confirm is that your backup is older than the hack itself. That can be weeks before the day you noticed it.

Whichever route you take, Google recommends a fresh install of the software rather than an upgrade in place. WordPress.org agrees: reinstalling from the dashboard often only overwrites existing files, and hacks often add new ones.

Restoring a backup without fixing the cause rarely ends it. Google’s guide warns that if one infected file stays on the server, the site is more likely to be hacked again.

How do I get the “This site may be hacked” warning removed?

Clean the site first, then request a review in Google Search Console. In Search Console, open Security & Manual Actions, then Security issues. If the report lists issues, fix every one on every affected page, then click Request review and explain what you found, what you removed and how you closed the gap. That’s the process in Google’s Security Issues report help.

Before you click, Google’s request a review guide asks you to check four things: the site is verified in Search Console, the hacker’s content is gone, the vulnerability is fixed, and the clean site is back online and crawlable (not blocked by robots.txt or noindex).

How long it takes depends on the type of problem:

• Malware: Google says reviews take a few days.
• Spam (hacked pages and redirects): up to several weeks, because a person may need to check it.
• Once Google finds the site clean: warnings in browsers and search results are removed within 72 hours.

Send one request and wait. Google’s help warns that resubmitting while a request is pending can slow later reviews or mark you as a repeat offender. If you’ve never added your site to Search Console, do it now; our guide to why a website isn’t showing on Google walks through verifying a site.

Will a hacked website stop my Google Ads?

Yes. Ads that send people to a hacked page are disapproved under Google’s Compromised sites policy, which covers sites whose code “has been manipulated to act in ways that benefit a third party”. The policy also names running a content management system with known security holes that have been exploited.

The account itself isn’t shut down straight away. Google says it gives at least 7 days’ warning before suspending an account for this. To get ads running again:

1. In Google Ads, filter your ads by Policy details: Compromised site to see which are affected.
2. Clean the site and remove any code that calls the domains Google names in the disapproval.
3. Request the Search Console review above, so the domain comes off Google’s Safe Browsing list.
4. Appeal the ads: hover over the ad status, click Appeal, choose “Made changes to comply with policy”, select the ads and submit.
5. Allow up to 72 hours for Google to recrawl the landing page. If the site can’t be fixed quickly, point the ads at a different, clean page in the meantime.

For a plumber or roofer who gets most of their calls from ads, this can be the most expensive part of a hack. A spare landing page on a separate, clean setup keeps the phone ringing while the main site is fixed.

Example: a plumber’s site that redirected mobile visitors

The example below is made up to show the steps in order. A plumbing company’s WordPress site looks fine on the owner’s laptop. Google Ads then disapproves every ad with “Compromised site”, and a customer mentions the site sent them to a prize page on their phone.

1. The owner calls the host, who confirms other sites on the account are clean and puts up a holding page with the phone number on it.
2. The owner changes the hosting, WordPress, FTP, registrar and email passwords from a scanned computer, and deletes an admin user they never created.
3. The host has nightly backups going back 30 days. The plugin that was exploited was last updated six months ago, so the cleaner restores a backup from before the first spam page appeared in site: results, then updates WordPress, the theme and every plugin, and deletes three plugins nobody uses.
4. Search Console shows hacked spam under Security issues. The owner requests one review, explaining what was removed and which plugin was the entry point.
5. The ads are pointed at a clean landing page and appealed the same day.

The timings to expect come from Google’s own help pages: up to 72 hours for ads to be re-checked, and anything from a few days to several weeks for the search warning, depending on whether it was malware or spam.

Should I fix a hacked website myself or pay someone?

Pay someone unless you’re comfortable reading code and using server tools. Google’s build a support team guide says fixing a hack yourself means reading code, working on the command line and sometimes changing server settings, and suggests a qualified professional if you can’t do that. Use this checklist to decide:

• Your host has a clean backup from before the hack and will restore it: you can often handle this with the host, then update everything.
• No clean backup, or the hack came back after a restore: hire a professional.
• Card payments, customer logins or personal data were on the site: hire a professional and ask them what you need to tell customers.
• Ads are disapproved and leads have stopped: get the ads onto a clean page first, then fix the site without rushing.
• The site is old, unsupported or built on a theme nobody updates: price a rebuild alongside the clean-up, because a cleaned site on outdated software is likely to be hit again.

Be wary of anyone promising a full clean in minutes with one plugin. Scanners help, and WordPress.org suggests running more than one. A scan on its own won’t show how the attacker got in, and that’s the part its guide says you have to investigate.

How do I stop my website getting hacked again?

Close the gap the attacker used, then keep the site updated. Google’s list of the top ways sites get hacked by spammers starts with weak or reused passwords, missed security updates and outdated or pirated themes and plugins. The fixes:

• Turn on automatic updates for WordPress, plugins and themes where you can, and check monthly that they ran.
• Delete plugins and themes you don’t use. Only install them from WordPress.org or well-known companies, as WordPress’s hardening guide advises, and never use “free” copies of paid ones.
• Use a long, unique password for each login and turn on two-step verification.
• Give admin access only to people who need it, and remove old freelancers’ accounts.
• Keep several dated backups stored away from the site, so a hack that goes unnoticed for weeks still leaves you a clean copy.
• Use SFTP instead of FTP, and keep the site on HTTPS. If your browser shows a “Not secure” warning, our post on why a website says not secure explains the fix.
• Add the site to Search Console so Google can email you the next time it spots a problem.

Updates, backups and someone checking them cost money every month, which is why they’re a line in any honest quote. Our guide to how much a website costs for a small business shows how to budget for them. If you’d rather hand it over, our websites service builds and looks after sites for local service businesses, with updates and backups agreed in writing.

FAQ

How long does it take to fix a hacked website?

Restoring a clean recent backup can be done the same day. Cleaning a site with no backup takes longer, and Google’s review adds a few days for malware or up to several weeks for spam. Once Google finds the site clean, browser and search warnings are removed within 72 hours.

Can I block Google with robots.txt while I fix the site?

That doesn’t protect anyone. Google’s quarantine guide says robots.txt only stops search engine crawlers, so customers can still reach the hacked pages. Ask your host for a holding page served from outside the infected site instead.

Should I delete my website and start again?

Not before you’ve taken a copy and found how the attacker got in. WordPress.org says it can be tempting to purge everything, and recommends replacing the core WordPress folders with a fresh copy and checking the rest. Rebuilding on the same weak setup leaves the same hole open.

Why can’t I see the hack when customers can?

Some hacks show spam only to certain visitors or only to search engine crawlers, which Google calls cloaking. Google’s FAQ also says Safe Browsing warnings depend on the visitor’s browsing context. Check from your phone using a Google search, run a site: search, and look at the Security issues report in Search Console.

Sources: 1. How do I know if my site was hacked? (web.dev, Google). 2. Hacked with malware (web.dev, Google). 3. FAQ for hacked sites (web.dev, Google). 4. Quarantine your site (web.dev, Google). 5. Build a support team (web.dev, Google). 6. Clean and maintain your site (web.dev, Google). 7. Request a review (web.dev, Google). 8. Top ways sites get hacked by spammers (web.dev, Google). 9. Security Issues report (Search Console Help). 10. Compromised sites (Google Ads Advertising Policies Help). 11. FAQ My site was hacked (WordPress.org). 12. Hardening WordPress (WordPress Developer Resources).

id=”rf-social-icons-source” style=”display:none”>