Website Hacked? What to Do in the First 24 Hours

Discovering that your website has been hacked can be stressful, especially when the site generates leads, processes customer information, or supports day-to-day business operations. The first few hours matter because rushing into cleanup without understanding the compromise can make recovery harder. Your priority should be to contain the incident, secure access, assess the damage, recover safely, and prevent the attacker from getting back in.

Quick Answer

If your website has been hacked, first confirm the compromise and limit further access. Secure your CMS, hosting, domain, email and related accounts from a trusted device. Preserve useful logs and evidence before deleting files, identify what was affected, then clean, restore or rebuild the website using a verified recovery point. Before going fully live, test the site and check for malware, unauthorized accounts, redirects and SEO issues.

Key Takeaways

• Don't immediately delete suspicious files without understanding what happened.
• Contain the compromised website before attempting extensive cleanup.
• Change important passwords and revoke unauthorized access.
• Check your CMS, hosting account, database, plugins and third-party services.
• Never assume the newest backup is automatically clean.
• A restored website can be compromised again if the original vulnerability remains.
• Check Google Search Console for security or indexing problems after recovery.
• Monitor the website closely after bringing it back online.

First, Confirm That Your Website Has Actually Been Hacked

Not every website problem is a security incident. A server outage, broken plugin, DNS issue or expired SSL certificate can produce symptoms that look alarming.

However, certain signs strongly suggest a compromise.

You may notice:

• Unexpected redirects to unfamiliar websites
• Unknown pages or posts appearing on the site
• A changed homepage or defaced website
• Malware or security warnings in browsers
• Unknown administrator accounts
• Suspicious JavaScript or code
• Files you don't recognize
• Spam pages appearing in search results
• Unexpected changes to website settings
• Unusual hosting activity
• Customers reporting strange pop-ups or redirects
• Login notifications you don't recognize

If several of these signs appear together, treat the situation as a potential security incident rather than simply a technical error.

If you use Google Search Console, check whether Google has reported security problems, hacked content or other search-related issues. Google Search Console can provide useful information about how Google sees your website.

The First 60 Minutes: Contain the Damage

Your first objective isn't to make every page look normal again. It is to stop the situation from getting worse.

Depending on the type of website and the severity of the compromise, that could mean temporarily taking the site offline, placing it behind a maintenance page, restricting access, or isolating the affected hosting environment.

If the website is still accessible to visitors and is serving malicious content, leaving it online can expose customers and potentially worsen SEO and reputation problems.

At this stage:

1. Restrict unnecessary access.
2. Put the affected website into an appropriate maintenance or restricted state.
3. Stop suspicious automated processes where you can safely identify them.
4. Avoid making large, uncontrolled changes to website files.
5. Record what you are seeing before the situation changes.

Don't assume that removing the visible hacked homepage solves the problem. Attackers can leave additional files, accounts, scripts or scheduled processes behind.

Secure Your Accounts Before You Start Cleaning

One of the biggest mistakes after a website hack is cleaning the website while leaving the attacker's access untouched.

A compromised website may be only one part of the problem. An attacker could also have obtained credentials for the hosting account, CMS, FTP/SFTP, domain registrar, email or connected services.

From a trusted, malware-free device, review and secure:

• CMS administrator accounts
• Hosting control panel
• Domain registrar
• FTP and SFTP accounts
• Database credentials
• Business email accounts
• Google accounts
• Search Console
• Analytics accounts
• Cloud services
• API keys and connected applications

Change passwords to strong, unique credentials and enable two-factor authentication wherever possible.

Also check the list of users. Remove accounts that you don't recognize and review whether legitimate accounts have unexpectedly gained administrator privileges.

The goal is simple: don't clean a compromised website while the attacker still has a valid way back in.

Preserve Evidence Before Deleting Suspicious Files

It can be tempting to open the hosting file manager and delete anything that looks unfamiliar.

Resist that temptation when possible.

A suspicious file, login record or server log may help establish how the attacker entered and what they changed. Deleting everything immediately can make it more difficult to understand the incident.

Preserve useful information such as:

• Hosting access logs
• Error logs
• Security scan reports
• Recent login activity
• Unknown administrator accounts
• Suspicious filenames
• Modified files
• Unexpected database entries
• Timestamps of unusual activity
• Security plugin alerts

You don't necessarily need to perform a full forensic investigation yourself. The important point is to avoid destroying useful information before the scope of the incident is understood.

For more complex incidents, professional investigation may be appropriate, particularly when customer data, payment information or other sensitive systems could be involved.

Check What Was Actually Affected

A hacked homepage doesn't necessarily mean the entire website was compromised, but it also doesn't mean the homepage was the only affected component.

Look at the major layers of the website.

Website Files

Check for unexpected files, recently modified files, unfamiliar scripts and suspicious code injections.

CMS

Review administrator accounts, permissions, configuration changes and recent activity.

Plugins and Themes

Outdated or vulnerable plugins, themes and extensions can become entry points. Remove components that are no longer needed and update legitimate software after the immediate incident is under control.

Database

Check for unexpected users, spam content, modified settings and suspicious records.

Hosting Environment

Review FTP/SFTP accounts, scheduled tasks, server settings and other hosting-level changes where you have access.

Third-Party Services

Don't forget connected forms, APIs, analytics, email platforms, payment services and other integrations.

This broader review matters because the visible website is only one layer of a modern web system.

Should You Restore the Website From a Backup?

A clean backup can dramatically simplify recovery, but restoration isn't automatically the right answer.

The key question is:

Was the backup created before the compromise and is it known to be clean?

Suppose an attacker entered the website two weeks ago and your backup was created three days ago. Restoring that backup could simply put the compromised files back onto the server.

Before restoring, consider:

• When was the backup created?
• When did the compromise likely begin?
• Does the backup include both files and the database?
• Was the vulnerability already present?
• Are important recent business changes stored outside the backup?
• Can the same vulnerability be exploited after restoration?

A backup is a recovery tool, not a guarantee that the restored website will remain secure.

You also need to address the vulnerability that allowed the attacker to enter in the first place.

Clean, Restore or Rebuild?

There are generally three possible recovery approaches.

Restore

Restoration can make sense when you have a reliable, verified clean backup and the compromise is reasonably understood.

This is often faster than manually removing malicious code from a heavily modified website.

Clean

Cleaning involves identifying and removing malicious files or code while preserving legitimate website content and recent changes.

This can be useful when the business cannot afford to lose recent database records, customer submissions or other updates.

However, thorough cleaning requires more than deleting the most obvious malicious file.

Rebuild

In some cases, rebuilding is the safer option.

A heavily compromised, outdated or poorly maintained website may contain too many unknown changes to trust. Rebuilding from known-clean source files and data can provide a more controlled recovery path.

The right choice depends on the CMS, the extent of the compromise, the quality of available backups and the business importance of the website.

Don't Forget the SEO Damage

A website hack can become an SEO problem surprisingly quickly.

Attackers may create spam pages, insert malicious redirects, inject unwanted content or use the website to distribute phishing pages.

Possible consequences include:

• Unexpected URLs indexed by Google
• Spam search results
• Malicious redirects
• Browser security warnings
• Reduced organic visibility
• Loss of visitor trust
• Temporary ranking disruption

Cleaning the website is therefore only part of the recovery process.

After the technical cleanup, check indexed URLs, important landing pages, redirects, robots.txt, sitemap files and Google Search Console reports.

If you discover hundreds of unexpected URLs, don't simply delete them and assume the SEO problem is finished. First understand why those URLs existed and whether the underlying compromise has been fully removed.

Your First 24 Hours: A Practical Recovery Timeline

When everything is happening at once, a timeline helps keep the response organized.

0-1 Hour: Confirm and Contain

• Confirm signs of compromise.
• Restrict the affected website where appropriate.
• Record what you see.
• Avoid uncontrolled file deletion.
• Identify critical systems connected to the website.

1-3 Hours: Secure Access

• Change important passwords.
• Enable two-factor authentication.
• Review administrator accounts.
• Remove unauthorized users.
• Revoke suspicious API keys or sessions.
• Secure hosting and domain accounts.

3-6 Hours: Assess the Scope

• Review logs.
• Check recently modified files.
• Inspect CMS accounts and settings.
• Check plugins, themes and integrations.
• Look for suspicious database changes.
• Determine the likely entry point.

6-12 Hours: Choose the Recovery Method

Decide whether the safest approach is to:

• Restore from a verified clean backup
• Clean the existing installation
• Rebuild affected components

At the same time, patch the vulnerability that allowed the compromise.

12-24 Hours: Test Before Going Fully Live

Check:

• Homepage and important pages
• Forms
• Login functionality
• Checkout or payment flows
• Redirects
• Images and scripts
• Analytics
• Third-party integrations
• Mobile experience
• SSL certificate
• Search-engine visibility

Then monitor the website for suspicious activity after it returns to normal operation.

What Not to Do After a Website Hack

The wrong response can make recovery harder.

Don't Panic-Delete Files

A malicious file may be obvious, but deleting files without understanding their purpose can break the website and destroy useful evidence.

Don't Restore an Unverified Backup

A backup created after the compromise may contain the attacker's code.

Don't Change Only One Password

If the attacker obtained hosting, email or FTP credentials, changing only the CMS password may leave other access routes open.

Don't Assume One Malicious File Is the Whole Problem

Attackers may create multiple files, users or persistence mechanisms.

Don't Ignore the Original Vulnerability

Removing malware without fixing the vulnerable plugin, outdated software, weak credentials or compromised integration can lead to reinfection.

Don't Bring the Website Back Online Without Testing

A website that looks normal on the homepage can still contain malicious redirects, hidden pages or compromised administrative access.

When Should You Bring in a Professional?

Not every website incident requires a large cybersecurity operation. But some situations justify professional help quickly.

Consider getting specialist assistance if:

• Customer or sensitive information may have been exposed.
• The attacker still appears to have access.
• Malware returns after cleanup.
• You don't have a reliable backup.
• Multiple accounts were compromised.
• The server itself may be affected.
• Google has flagged the website for security problems.
• The website generates significant revenue or leads.
• The entry point cannot be identified.
• The website uses custom applications or complex integrations.

For businesses that need deeper technical changes after an incident, custom web development can also become part of the recovery process when the existing implementation needs to be rebuilt, modernized or hardened.

The key is to match the response to the actual scope of the incident rather than treating every hack as a simple file-cleaning exercise.

How to Prevent the Next Website Hack

Recovery should end with prevention.

Start with the basics:

• Keep your CMS and dependencies updated.
• Remove unused plugins, themes and extensions.
• Use strong, unique passwords.
• Enable two-factor authentication.
• Limit administrator privileges.
• Maintain regular backups.
• Test that backups can actually be restored.
• Secure hosting and database access.
• Monitor login activity.
• Review third-party integrations.
• Use HTTPS correctly.
• Scan for suspicious changes.
• Keep server software maintained.
• Monitor the website after major updates.

Security is not a one-time installation. A website becomes harder to protect when its software, credentials, integrations and hosting environment are left unmanaged for long periods.

FAQs

What should I do first if my website is hacked?

First, confirm the signs of compromise and contain the affected website. Restrict unnecessary access, secure important accounts from a trusted device and avoid randomly deleting files. Then preserve useful logs and investigate the likely entry point before choosing a cleanup, restoration or rebuild strategy.

Should I take my hacked website offline?

If the website is actively serving malware, phishing content or malicious redirects, temporarily restricting access can reduce risk to visitors and prevent further damage. The exact approach depends on the incident. A maintenance page, access restriction or hosting-level isolation may be appropriate while the compromise is investigated.

Can I restore a hacked website from a backup?

Yes, if the backup is known to be clean and was created before the compromise. However, restoration alone isn't enough. You should identify and fix the vulnerability that allowed the attacker in, secure compromised credentials and test the restored website before returning it fully to production.

Can a hacked website damage my Google rankings?

Yes. A compromised website can generate spam pages, malicious redirects, unwanted content and security warnings that affect search visibility and visitor trust. After recovery, check Google Search Console, indexed URLs, redirects and important pages to confirm that the website is no longer serving compromised content.

How long does it take to recover a hacked website?

There is no universal recovery time. A small website with a verified clean backup may be recovered relatively quickly, while a complex website with unknown access, persistent malware or server-level compromise can take considerably longer. The first 24 hours should focus on containment and assessment rather than promising a specific recovery time.

Conclusion

A hacked website is a business incident, not just a technical inconvenience. The fastest way forward is usually a controlled response: contain the compromise, secure access, understand what happened, recover from a trusted state and fix the weakness that allowed the attack.

If your website needs technical recovery, rebuilding or broader development support, Milaaj Brandset can help businesses assess and improve their digital infrastructure while working toward a more secure and maintainable website.