The short answer
If your website has been hacked, the order matters more than the speed: contain the damage first, find out how they got in, then clean or restore — and only then reopen the doors. Resist the urge to start deleting things or reinstalling everything immediately; a rushed clean-up that misses the entry point usually means the site is infected again within days. If the site is your business's shopfront and you don't have a backup you know is clean, this is normally a professional job. Asking what's involved costs nothing — our website repair service starts with an honest look, not a sales pitch.
How to tell you've actually been hacked
The common warning signs: Google shows 'This site may be hacked' or the browser shows a red deception warning; visitors get redirected to sites they never asked for; strange pages appear in search results for your domain — often pharmaceutical or gambling keywords in another language; there are admin users you didn't create; your hosting company suspends the account or emails about malware; customers report odd behaviour; or the site becomes suddenly, heavily slow. One honest caution before the panic: several of these signs have innocent causes. A crashed update can look like a hack, and a browser warning can follow an expired security certificate. Confirm before you conclude — our guide to what to do when a website goes down helps you separate a hack from an ordinary outage.
Want a professional pair of eyes on your own site? Request a free website review — plain-English findings, no obligation.
First hour: contain the damage
From a device you trust — not necessarily the one you usually work on — change the important passwords: hosting control panel, website admin, database and any FTP access. If the site is actively redirecting visitors or serving malware, put it into maintenance mode or ask your host to take it offline temporarily; an offline site for a day does far less damage than a site quietly infecting customers. Tell your hosting provider — they see attacks across thousands of sites and can often tell you quickly what they're seeing. Write down what you noticed and when: a rough timeline of symptoms is genuinely useful evidence for whoever investigates. Hold off announcing anything publicly until you know what's actually happened.
What not to do
Don't restore the first backup you find before working out when the break-in happened — backups taken after the compromise restore the infection along with the site. Don't 'clean' by deleting files that look suspicious unless you know what they are; hackers count on panic-deleting breaking the evidence trail. Don't keep the site live and hope nobody notices — Google blacklists compromised sites and visitors can be harmed. Don't pay or reply to ransom-style emails claiming they'll 'release' your site. And don't reinstall everything before the entry point is known: a fresh install over an open hole is a fresh victim.
Backups: your best and trickiest friend
A backup is only useful if it predates the compromise. Work out when the attackers got in — hosting file-change dates, access logs and the Security Issues report in Google Search Console all help narrow it down — then choose a backup from comfortably before that point. Keep a copy of the hacked site rather than wiping it; it holds the evidence needed to find the entry point. And test the backup somewhere safe before it overwrites the live site: a backup that restores cleanly in a test area is a recovery, while one that fails mid-restore on the live site is a second emergency. Your host may hold backups you don't know about — ask before assuming you have none.
Credentials and access: close the doors
Assume every password associated with the site is now known to someone else. Reset the hosting control panel, every CMS admin account, the database password and FTP or SSH access. Remove admin users you don't recognise and check the email addresses on the accounts you keep — attackers often change the recovery email so they can walk back in. Look for unfamiliar API keys, scheduled tasks or 'must-use' plugins you never installed. Where two-factor authentication is available, turn it on. Do this before or during the clean-up, not after: cleaning a site while the attackers still hold working keys is mopping with the tap running.
Finding and removing the malware
A proper clean-up compares your files against known-clean copies, hunts for obfuscated code hiding in legitimate-looking files, checks the database for injected content and spam pages, and reads the logs to find the door they used. Free online scanners are a reasonable first look, but they only see the public surface — backdoors are specifically built to survive them. This is the part where experience genuinely matters, because the visible damage is rarely the whole story. The goal isn't just removing what you can see; it's answering 'how did they get in?' — an outdated plugin, a weak password, a compromised theme — and closing that specific door, otherwise you're booking the same job again next month.
Restoring safely and clearing the warnings
Once the site is rebuilt from known-clean files, verify everything before calling it done: key pages, forms, logins, and checkout if you sell online. If Google flagged the site, request a review through Search Console's Security Issues report — warnings usually lift within days once Google confirms the site is clean, and until they do, some visitors will still see the red screen. If the domain was used to send spam, watch your email deliverability; blacklists can outlive the hack itself. Then monitor for a few weeks: reinfection attempts often follow a clean-up, and catching one early is the difference between a bad week and a bad year.
Preventing a repeat
Almost every hack we see traces back to the same short list: software that wasn't updated, a weak or reused password, a plugin from an untrustworthy source, or hosting that hadn't kept up. The prevention is unglamorous but effective: updates applied promptly and tested, strong unique passwords with two-factor authentication, the fewest possible admin accounts, and a site someone is actually watching. Our plain-English guide to website security basics covers the essentials, and if you'd rather not carry the routine yourself, a maintenance plan keeps updates, backups and monitoring handled.
When to get professional help — and what it costs
Get help promptly if the site takes orders or holds customer data, if Google has blacklisted it, if you have no backup you're confident is clean, or if this isn't the first time. A proper repair includes the investigation, the clean-up, closing the entry point, testing, and a plain-English account of what happened — not just a scan and an invoice. Most single repairs are quoted from £95, depending on the cause and complexity. You approve a fixed written quote before any work begins, and the initial enquiry is free: tell us what's happened and you'll get an honest assessment, including when we think you can safely handle it yourself.
Common questions
Will I lose everything? Usually not — most hacks deface or exploit rather than delete, and hosting backups often exist even when you never set one up. Should I tell my customers? If customer data or payments could be involved, yes — and UK GDPR can require reporting personal-data breaches to the ICO within 72 hours, so take advice quickly rather than hoping it stays quiet. Can I just change my passwords and carry on? Passwords alone don't remove whatever was planted; they're step one, not the fix. How long does a proper clean take? It depends on the damage and the evidence, and anyone promising a fixed timeframe before looking is guessing — you'll always get an honest timescale from us once we can see what happened.
Want this handled for you?
Get a free, plain-English review of your website — what's working, what isn't, and what's worth fixing first.
Get a Free Website ReviewRelated services: Website Repairs · Website Maintenance