Your website has been hacked. What to do in the first hour.

The short answer

A hacked website is one where someone has added code, pages or users without your permission. For small businesses it's almost always a WordPress site with an out-of-date plugin or theme, or a leaked password. It's fixed in three steps: close the door they came in through, clean up everything they left behind and ask Google to review it. If you only delete what you can see, it comes back.

How you can tell

• Redirects to spam. You go to your website from Google or on your phone and end up on a gambling, pills or fake prize page. Sometimes it only happens from Google or only on mobile. That's why you don't see it and your customers do.
• Google's warning. "This site may be hacked" appears next to your website in the results, or Chrome shows a red screen before letting you in.
• Pages that aren't yours. You search for "site:" followed by your domain and up come pages in Japanese, fake brands or products you don't sell.
• Spam from your domain. You get bounce-backs for emails you never sent, or customers tell you you've been sending them strange messages. Sometimes it's the website. Other times it's an email account with a leaked password or someone spoofing your domain.
• Users nobody created. There are administrators in WordPress you don't recognise.

What to do in the first hour

• Change the passwords for the website admin, the hosting, FTP and email from a computer you know is clean.
• Ask your hosting provider for a backup from before the attack and whether they've noticed anything. Many keep backups going back several days.
• Add the website to Search Console if it isn't there yet and open the Security issues report. That's where Google shows what it has found, with examples of affected URLs.
• Write down what you see and since when: screenshots, the addresses it redirects to and dates. It helps with the clean-up and with Google's review.
• Audit your website in 20 seconds on the home page. If the home page loads third-party scripts you didn't add, it shows up in the checks.

What not to do

• Don't open infected pages in your everyday browser. Google advises against it in its help. To see what they serve, use the URL Inspection tool in Search Console.
• Don't just delete what you can see. Removing the redirect without closing the door they came in through is cleaning up so they can come back. There's usually a backdoor hidden in a file somewhere.
• Don't just restore a backup. If the backup dates from when the hole was already there, they get back in. Restore the backup, then update everything and close whatever failed.
• Don't pay anyone who promises to remove Google's warning within hours. Google removes the warning when it reviews the website and finds it clean. Be wary too of miracle plugins that "clean everything" in one click.
• Don't request the review too early. Google asks you to clean every affected page, not just the examples in the report. It also asks you not to send another request while the previous one is pending.

How it gets cleaned up

Google has a guide for hacked websites and explains the review in its help for the Security issues report. What I do, in order:

• I copy everything exactly as it is, before touching anything.
• I find out how they got in: plugin, theme, password or server. Without that, it fills up again.
• I clean the files, the database and the users. I remove the pages they created.
• I update everything, remove what isn't needed and protect access to the admin.
• I check from the outside that the website no longer redirects, on mobile and from Google.
• I request the review in Search Console, explaining what happened and what has been done.
• I leave active monitoring in place: a Telegram alert if the website goes down, if the certificate is about to expire or if the domain is about to lapse.

When to call someone in

If the website gets reinfected after cleaning, if you can't find how they got in or if Google has already added the warning, the problem goes deeper than what you can see. Every day with the warning means people seeing your name next to "hacked" and not clicking through.

Sometimes it's best not to go back to WordPress

An old WordPress site with lots of plugins and nobody updating it gets hacked again. If the website is simple, it can pay to rebuild it as a static website, with no admin panel or database to attack and every old address redirected to the new one. I look at each case and tell you before I start. If the website also shows errors or won't load or the contact forms aren't arriving, it all gets fixed together.

If you'd rather not wrestle with this

Tell me what you see, when it started and what the website is built with. I'll tell you what has happened and what it takes to clean it up and secure it, with a fixed price before I start. What I can't promise is when Google removes the warning. Google decides that when it reviews the site. I work remotely, in English, with businesses outside Spain. I don't compete on price. I compete on quality and speed.

Questions