Website Hacked? What to Do in the First 24 Hours

When your website is hacked, contain it first, then save a copy for evidence, change every password, find how the attacker got in, clean or restore the site, patch the hole, and ask Google to review it. Do these steps in that order. Deleting files or restoring a backup before you know the entry point is the most common reason a site gets reinfected within days.

I have done security research since 2011 and have been acknowledged by Google, BlackBerry and TeamViewer for reported vulnerabilities. The plan below is the same order I follow when a business owner tells me "my website has been hacked."

Hour 0-1: Contain the damage without destroying evidence

Contain the breach by taking the site offline for visitors while keeping every file and database row exactly as the attacker left it. Your goal in the first hour is to stop harm to visitors, not to fix anything yet.

Take these 4 actions in the first hour:

1. Put the site into maintenance mode, or block public traffic at the host or firewall level and return a 503 status code.
2. Leave the infected files in place. Do not delete suspicious files, plugins or users yet.
3. Write down what you saw and when: the redirect URL, the warning message, the email from your host, screenshots.
4. Tell your host. Most hosts have a security team and server logs you cannot access yourself.

A 503 status tells Google the outage is temporary, so a short maintenance window does not cause pages to drop out of the index. A blank page or a 404 sends the wrong signal.

Hour 1-2: Back up the compromised state for forensics

Back up the hacked site before you change anything, and label the copy "infected" so nobody restores it by mistake. This copy is your evidence. It shows which files changed, when, and through which account or script.

The forensic copy needs 3 parts:

• Files: the full web root, including uploads and cache folders.
• Database: a complete export, not only the posts table.
• Logs: web server access logs, error logs and any control panel login history.

Store the copy offline or in a separate account. Hosts rotate logs every few days, so download them now.

Hour 2-3: Change every credential and turn on 2FA

Change every password and key that touches the site, starting with the accounts that control everything else. Attackers commonly create backup access, so a single password change rarely locks them out.

Rotate credentials in this order:

1. Hosting and domain registrar accounts.
2. CMS administrator accounts, for example every WordPress user with the Administrator role.
3. Database user passwords, then update the config file that stores them.
4. FTP and SFTP accounts, plus SSH keys on the server.
5. API keys and secrets, for example payment gateway, email service and analytics keys.
6. WordPress security salts in wp-config.php, which signs out every active session.

Enable two-factor authentication on the host, registrar, CMS admin accounts and Google Search Console. Then check Search Console's verified owners. Google's guide on the Japanese keyword hack (web.dev, Google) states that an unknown verified owner is a strong sign of a hack, because attackers add themselves to change sitemaps and geotargeting. Remove any owner you do not recognise.

Hour 3-6: Identify the type of hack

Identify the hack type by what visitors, Google and your files show. Google's spam policies (Google Search Central) define hacked content as "any content placed on a site without permission, due to vulnerabilities in a site's security," and group it into code injection, page injection, content injection and redirects.

These are the 5 patterns I see most often:

• SEO spam pages: thousands of new URLs selling counterfeit goods or pills. The Japanese keyword hack is the best-known example. Run site:yourdomain.com in Google and page through the results to find them. Removing the Japanese keyword hack covers this variant step by step.
• Conditional redirects: visitors from Google or on mobile get sent to a scam site, while you, typing the URL directly, see a normal page.
• Defacement: the home page is replaced with the attacker's message. It is loud but often the least damaging.
• Malware or phishing: injected JavaScript that loads malicious files, or fake login pages hosted in a subfolder.
• Injected admin users: new administrator accounts with plausible names, for example "wpadmin" or "support."

Many SEO spam hacks use cloaking. The attacker serves spam only to Googlebot and a clean page to everyone else. Use the URL Inspection tool in Search Console to see what Google actually receives.

Hour 6-12: Find the entry point

Find the entry point before you clean anything, because cleaning without patching invites the same attacker back. The forensic copy and logs from hour 1 do the work here.

Check these 4 sources of entry:

1. Outdated plugins and themes. Patchstack's State of WordPress Security in 2025 (Patchstack, 2025) counted 7,966 new WordPress vulnerabilities in 2024, with 96% in plugins and 4% in themes, and 33% not fixed by the time they were publicly disclosed.
2. Weak or reused passwords. Look for successful admin logins from unfamiliar IP addresses in the access log.
3. Vulnerable custom code. File upload forms, unvalidated input and broken access checks. The OWASP Top 10:2025 (OWASP, 2025) ranks Broken Access Control first and Injection fifth.
4. Other sites on the same hosting account. One infected staging site or abandoned blog spreads to every site sharing that account.

Sort files by modification date and compare them against a clean copy of the same CMS and plugin versions. Files in the uploads folder that end in .php are a red flag on WordPress.

Why a code background matters during a breach

A WordPress site hacked through a plugin is only half the question. The other half is what the attacker did with that access, and that answer lives in PHP, JavaScript and database rows, not in a security plugin's dashboard. I have written production code for over 10 years in PHP, Python and JavaScript, so I read the injected code itself. This tells me whether the attacker only planted spam pages or also stole customer data, which changes who you need to notify. The file-by-file cleanup is in how to remove malware from a WordPress site.

Hour 12-20: Clean or restore, then patch

Clean the site or restore it from a backup taken before the infection date, then patch the entry point before the site goes live again. The infection date comes from the earliest modified file or the first suspicious log entry.

Choose the method based on what you have:

• Restore if you hold a backup dated before the first sign of compromise. Then reapply content added since, after checking it.
• Clean manually if no clean backup exists. Replace CMS core, plugins and themes with fresh copies from the official source, then inspect custom code, the uploads folder and the database line by line.

To remove malware from a website properly, also search the database. Injected scripts often sit in post content, widget settings or option rows, so a file-only cleanup leaves the infection running.

Then patch:

1. Update the CMS core, every plugin and every theme.
2. Delete plugins and themes you do not use.
3. Fix the vulnerable custom code you found in hour 6-12.
4. Set correct file permissions and block PHP execution in upload folders.
5. Add a web application firewall in front of the site.

Hour 20-24: Clear Google warnings and blocklists

Clear the warnings by requesting a review in Search Console and checking every blocklist your visitors' browsers use. A cleaned site still loses traffic until these flags come off.

How a hack damages your SEO

A hack damages SEO in 3 ways. Google labels results "This site may be hacked" when, in Google's words (Google Search Help), "a hacker might have changed some of the existing pages on the site or added new spam pages." Browsers show a full-screen red warning for malware or phishing. Spam pages dilute the site's index and attract spam backlinks, and in severe cases Google drops affected pages from results. Start with my guide to diagnosing a website traffic drop if your rankings fell and you are not sure a hack is the cause.

Request a review in Search Console

Open the Security Issues report in Search Console and select Request Review only after every listed issue is fixed. Google's Security Issues report documentation (Google Search Console Help) states that a review "can take from a few days to a few weeks," and warns against resubmitting while a request is pending. Describe exactly what was wrong, what you fixed and how you verified it.

Check blocklists

Check the Google Safe Browsing site status tool (Google Transparency Report) for your domain. Google Safe Browsing (Google) protects "over five billion devices every day" and feeds the warnings in Chrome, other browsers, Google Search and Gmail. Then scan the domain on VirusTotal, which checks it against dozens of security vendors at once, and contact any vendor that still flags it.

After 24 hours: Monitor for reinfection

Monitor the site daily for 30 days, because reinfection usually comes through a backdoor missed during cleanup. A backdoor is a small hidden script that lets the attacker back in after the visible damage is gone.

Watch these 4 signals:

• New or changed files, using file integrity monitoring.
• New admin users in the CMS and new owners in Search Console.
• Indexed spam URLs, by repeating the site: search weekly.
• Search Console Security Issues, with email alerts switched on.

Once the site is stable, run a full review with my website audit checklist so security, speed and SEO problems surface together instead of one crisis at a time.

Frequently asked questions

How do I know if my website has been hacked?

The clearest signs are a "This site may be hacked" label in Google results, a browser malware warning, an email from Search Console, redirects to unrelated sites, or strange pages appearing in a site:yourdomain.com search. Unknown admin users and unknown Search Console owners are also strong signs.

Should I delete my hacked website and start again?

Do not delete a hacked website before you back it up and find the entry point. Deleting it destroys the evidence of how the attacker got in, and a rebuild on the same hosting, plugins and passwords gets compromised the same way.

How long does it take Google to remove a hacked site warning?

Google states that a Security Issues review takes from a few days to a few weeks after you request it in Search Console. The review only starts after you fix every listed issue and submit the request.

Can a hacked website get its Google rankings back?

A hacked website recovers its rankings once the spam pages are removed, the warnings are cleared and Google recrawls the clean pages. Recovery is faster when the site is cleaned within days rather than months, because fewer spam URLs get indexed and fewer spam links point at them.

Is a security plugin enough to fix a WordPress site hacked through a plugin?

A security plugin alone is not enough, because it scans for known malware signatures and misses custom backdoors and database injections. A complete fix also includes updating the vulnerable plugin, rotating every credential and checking the database by hand.