Your Site’s Been Hacked—Now What?
If you’re reading this, chances are your website is down, defaced, showing pop-ups, or flagged by Google. It’s a nightmare for any business—especially if you rely on that site for leads, sales, or credibility.
But here’s the good news: You’re not the first to go through this, and you can absolutely recover with the right steps.
This guide walks you through what to do immediately, what tools to use, and how to harden your site so it never happens again.
🚨 Business Website Hack Recovery Guide
If your website is down, defaced, showing pop-ups, or flagged by Google, this step-by-step guide will help you recover quickly and securely. Follow these 8 critical steps for full recovery.
| Recovery Step | Immediate Actions Required | Tools & Resources |
|---|---|---|
| 1 Take Site Offline | Temporarily disable public access to prevent further damage and protect customers from malware infection. ⚠️ DO NOT delete the site – just disable access Methods:
| Hosting Control Panel Options: • cPanel maintenance mode • Cloudflare “Coming Soon” page • .htaccess redirect rules • Firewall traffic blocking 💡 Keep the site accessible to you for investigation |
| 2 Confirm & Identify | Verify the hack and document symptoms for proper remediation strategy. Check for:
| Google Transparency Report Sucuri SiteCheck File Investigation: • FTP/SFTP file timestamps • Server access logs • CMS admin user lists • Database recent changes |
| 3 Full Security Scan | Run comprehensive malware detection using both server-level and CMS-level scanning tools. 💡 Download site copy before changes for forensics Scan Types:
| Wordfence (WordPress) ImunifyAV (cPanel) Sucuri Scanner MalCare Additional Scans: • Server-side antivirus • Custom malware signatures • Deep file analysis |
| 4 Clean Up or Restore | Remove malicious content and restore clean state based on infection scope and available backups. Options:
💡 Check for fake admin users and cron jobs | Cleanup Resources: • Recent clean backups • Fresh CMS downloads • Plugin/theme repositories • Database restoration tools Manual Cleanup: • Text editors for code review • FTP clients for file management • Database admin tools • Cron job managers |
| 5 Change All Credentials | Update every password and key that could have been compromised during the breach. 🔑 Critical: Change ALL passwords, not just admin Update:
| Password Management: • Strong password generators • Multi-factor authentication setup • API key regeneration portals Account Types to Update: • Web hosting control panel • Domain registrar • CDN services (Cloudflare) • Email hosting • Third-party integrations • Social media connections |
| 6 Harden Website Security | Close security gaps and implement protective measures to prevent future attacks. Essential Hardening:
| SecurityHeaders.com WPScan (WordPress) Security Enhancements: • WAF services (Cloudflare, Sucuri) • Security plugins (Wordfence, iThemes) • SSL certificate installation • File permission adjustments • Regular backup automation • Update management systems |
| 7 User Notification | Transparently communicate with affected users if customer data may have been exposed. Required Actions:
💡 Reputation is salvaged with honesty, not hiding | Communication Channels: • Email notification systems • Website banner announcements • Social media updates • Customer support scripts Legal Compliance: • GDPR notification requirements • State breach notification laws • Industry-specific regulations • Documentation for authorities |
| 8 Learn & Improve | Analyze what went wrong and implement long-term security improvements to prevent future incidents. Key Questions:
| Long-term Security: • Security audit checklists • Backup testing procedures • Incident response templates • Staff training programs Ongoing Monitoring: • Website uptime monitoring • Security scanning schedules • Performance monitoring • Regular penetration testing Professional Security Consultation |
🎯 Common Website Attack Types
Step 1: Take the Site Offline (Without Deleting It)
Temporarily disable public access—especially if the site is serving malware or redirecting visitors. You can:
- Put up a maintenance page
- Pause hosting via your provider’s dashboard
- Block traffic via
.htaccessor firewall rules
Why: This prevents more damage and keeps your customers from getting infected.
Step 2: Confirm the Hack and Identify the Symptoms
Check for:
- New admin accounts in WordPress, Joomla, etc.
- Files modified recently (especially in
/wp-content/,/plugins/, etc.) - Unexpected outbound traffic or redirect scripts
- Blacklist flags from Google Transparency Report
Recommended Tool:
Step 3: Run a Full Scan Using These Tools
Run both server-level and CMS-level scans. Here are a few go-to tools:
- Wordfence (for WordPress): Scans for malicious code and compares file hashes.
- ImunifyAV (cPanel users): Detects injected PHP shells and backdoors.
- Sucuri or MalCare (Managed plugins): Great for ongoing protection and cleanup.
Optional: Download a copy of your site before making changes, in case you need to show forensics or rollback to a different restore point.
Step 4: Clean Up or Roll Back
Depending on the scope of the hack, you can:
- Roll back to a clean backup (prior to infection date)
- Manually remove infected files and malicious scripts
- Delete unused plugins or themes
- Reinstall core CMS files (like WordPress core)
Pro Tip: Hackers often create fake admin users or cron jobs—check those too.
Step 5: Change All Credentials
Don’t skip this! Change all passwords and keys:
- CMS admin accounts
- Hosting and cPanel credentials
- FTP/SFTP accounts
- Database users
- Email accounts tied to site recovery
Also update any API keys (like Stripe, Mailchimp) that may have been exposed.
Step 6: Harden the Website
Post-cleanup, you need to close the doors the hacker used:
- Enable a web application firewall (WAF)
- Install security headers (Content-Security-Policy, X-XSS-Protection)
- Disable file editing in CMS
- Limit login attempts and enforce strong passwords
- Use a security plugin with file integrity monitoring
- Keep software and plugins updated weekly
Bonus Tools:
- SecurityHeaders.com — Analyze your HTTP headers
- WPScan — Check for known vulnerabilities in your WordPress setup
Step 7: Notify Affected Users (If Necessary)
If customer data may have been exposed:
- Notify users transparently
- Reset any exposed passwords
- Follow legal requirements (like GDPR or state breach laws)
Don’t try to hide it—reputation is salvaged with honesty.
Step 8: Learn From It
Ask yourself:
- Was the site regularly updated?
- Were backups in place?
- Was MFA enabled on hosting and admin logins?
- Did I have an incident response plan?
If not:
- Put one in place now.
- Schedule monthly audits.
- Consider a managed security plan.
Website Exploits Explained
Website hacks come in many forms, and knowing the type of attack can help you choose the right response strategy. Some of the most common include:
- Malware injection: Hidden code that redirects users, spreads viruses, or logs keystrokes.
- Defacement: The visible altering of your homepage or pages with threatening or political messages.
- SEO spam (pharma hacks): Your site starts ranking for unrelated, shady keywords.
- Phishing: Attackers create lookalike pages on your domain to trick users into giving up personal info.
- Credential stuffing: Hackers gain admin access by reusing passwords leaked from other breaches.
- File injection or backdoors: Shells placed inside plugins or themes that allow persistent access.
Each of these threats requires a specific approach to scan, clean, and harden your site.
Final Thoughts
Getting hacked feels personal—but it’s not the end. Most sites recover fully if the response is quick, clean, and strategic.
As a certified ethical hacker, I’ve helped dozens of businesses recover from website intrusions—and each one came out more secure than before.
Need a hand cleaning up or locking things down? Request a consultation with Forestal Security.
FAQs
How do I know if my business website was hacked?
Signs include defaced pages, slow loading, random redirects, admin lockouts, spammy pop-ups, or blacklisting warnings from browsers or search engines.
What is the first thing I should do after a website hack?
Take the site offline immediately to prevent further damage. Then scan for malware, check file changes, and preserve any logs or backups before making changes.
Can I fix a hacked website myself or do I need help?
If you’re technically skilled and the hack is minor, cleanup may be possible. But for major infections or ecommerce sites, it’s safer to work with a professional.
Will Google or my hosting provider block my site after a hack?
Yes. If malicious code is detected, Google will blacklist your site, and some hosts may suspend your account until it’s cleaned.
How long does it take to recover a hacked website?
Depending on the damage, cleanup can take anywhere from a few hours to several days. Recovery time improves with recent backups and a clear remediation plan.
How can I make sure this doesn’t happen again?
Use a web application firewall (WAF), update all software regularly, implement strong passwords, enable MFA, and conduct monthly security audits.
