Websites & online business
My website has been hacked. What do I do?
Your website is showing strange pages, redirecting visitors to scams, or Google has flagged it as dangerous. It’s alarming, but it’s fixable. Work through these steps in order, and resist the urge to just delete the odd files you can see, because there’s usually more hidden.
The short version
First steps
- Contact your web host or developer.
- Change every password: hosting, website, database, domain and email.
- Restore from a clean backup or have the site professionally cleaned.
- Update everything, then ask Google to review the site.
Signs your site has been hacked
- Visitors are redirected to scam, gambling or adult sites, sometimes only on mobile or from Google.
- Google search results show spammy titles or pages you didn’t create.
- Browsers or Google show a “Deceptive site ahead” or “This site may be hacked” warning.
- Your host has suspended the site or sent a malware notice.
- New admin users, posts or files you don’t recognise.
- Customers report odd emails or pop-ups after visiting.
Step 1: Contain it
Contact your host or developer
They can often see what’s happening on the server, take the site offline or show a maintenance page, and help with cleanup.
Put the site in maintenance mode if you can
This protects visitors while you work on it.
Keep evidence
Note what you’ve seen, when, and take screenshots. It helps whoever cleans the site find the cause.
Step 2: Change every password
From a computer you trust, change passwords for:
- Website admin accounts (and remove any you don’t recognise)
- Hosting control panel and FTP/SFTP
- Database
- Domain registrar and DNS
- Email accounts on the domain
Turn on two-step verification everywhere it’s offered.
Step 3: Clean or restore
| Option | When it suits |
|---|---|
| Restore from a clean backup | You have backups from before the hack, and know roughly when it started |
| Professional malware cleanup | No clean backup, or the hack has been there a long time |
| Rebuild the site | The site is old, unmaintained or heavily compromised |
After restoring, update the platform, themes and plugins immediately, or the same hole will be used again within days.
Step 4: Close the hole
Work out how they got in. Common causes:
- An outdated plugin, theme or platform version
- A weak or reused admin password
- A pirated (“nulled”) theme or plugin
- A compromised hosting or FTP password
- An old, forgotten copy of the site in another folder
Fix the cause, delete unused plugins and themes, and follow our website security checklist.
Step 5: Clear warnings
- In Google Search Console, check the Security issues report, confirm the problems are fixed, and request a review.
- If your host suspended the site, tell them it’s been cleaned and ask for a rescan.
- Check your domain isn’t listed on email blocklists if spam was sent from your server.
Customer data may be involved
If your site stores customer accounts, orders or enquiry forms, find out whether personal information was accessed. You may need to notify affected people and the OAIC. See reporting data breaches.
Report it
Report the incident through ReportCyber. Businesses can also call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371) for advice.
Common questions
Can I just delete the strange files?
Usually not enough. Attackers hide backdoors in several places, including the database. Restore from a clean backup or get a thorough cleanup.
How long until Google removes the warning?
After you request a review in Search Console, reviews often take from a day to a few days.
Why was my small site targeted?
It almost certainly wasn’t personal. Automated tools scan millions of sites for known weaknesses.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.