Website Hacked? What to Do, Step by Step (2026 Guide)
Written by Kamran, Founder, 3xRevenue. Published · 11 min read.
If your website was hacked, take it offline, copy it and change every password from a clean device. Then find how the attacker got in, clean or restore, and ask Google for a review. Move fast: Patchstack puts the weighted median time to first exploit for heavily exploited WordPress flaws at just 5 hours.
Maybe your site sends visitors to a casino page, or Google shows a red warning. Or your host suspended the account over malware.
This guide gives you a calm, ordered plan with costs. It also shows how to stop the hack from coming back. If you would rather hand it off, our team handles website rescue for hacked or broken sites at a fixed price.
Who hacked your site, and what their code is doing
A hack means someone other than you can change what your site does. Most small business hacks are not personal. Bots scan sites for a weak plugin, old PHP or a reused password, then plant code automatically.
GoDaddy's 2026 security report shows what that code usually does. Malware made up 41.5% of detections, SEO spam 35.2% and malicious redirects 21.7%. Defacements, the "hacked by" banners people picture, were only 0.5%.
That is why many owners do not notice for weeks. The site looks normal to them while it redirects mobile visitors or hides spam pages for Google. Meanwhile Google can flag your site, and your host can suspend it and take your forms down with it.
The 7 steps that get a hacked site back online
Lock the doors first, then clean. Skipping ahead to "clean it" is the most common reason sites get reinfected within days. Work through these steps in order.
1. Confirm it is a hack, then take the site offline
First rule out an expired domain, a failed update or a hosting outage. Real signs include redirects, admin users you did not create and strange pages in Google results. A Search Console warning is another.
Once you are sure, put the site in maintenance mode or ask your host to block public access. A 503 status code tells search engines the outage is temporary. That protects your listings while you work.
Example: A dental office sees its homepage redirect phones to a pharmacy spam site. The office manager asks the host to switch the site to a 503 maintenance page within 20 minutes.
Quick check: Load your site on your phone over mobile data, not your office Wi-Fi. If it still redirects, it is not offline yet.
2. Copy everything before you change anything
Download a full copy of the files and the database as they are now, and label it with the date. Screenshot what visitors and Google see. Write down when you first noticed the problem.
This copy is evidence for your insurer, processor or a security expert.
Example: Save site-hacked-2026-10-30.zip and a database export to an offline drive.
Quick check: Can you open the copy on a different computer? If not, it is not a usable backup.
3. Take back every account, from a clean device
Scan the computer you use to log in, or use a different one. Then change the passwords for hosting, the site admin, the database and FTP or SFTP. Change the email inbox tied to those accounts too.
Delete admin users you do not recognize. Turn on two-step login wherever it is offered.
Do not forget the accounts above the website. Check that your domain registrar, DNS and Google Search Console are still in your name. Our free DNS and email record checker shows where your domain points and whether your email records were changed.
Quick check: Make a list of every account and who holds the login. If any line says "the old developer," fix that first.
4. Find the way in
Cleaning without closing the door is wasted work. Look for an outdated plugin, an unknown theme, old PHP, a shared password or a new user. Your host's logs often show the first bad file change.
A quick scan with our website tech checker shows which platform and software your site exposes to the public.
PHP matters here. On October 21, 2026, the PHP project released fixes for two critical flaws. Both "can allow unauthenticated remote code execution." PHP 8.2 reaches end of life on December 31, 2026.
A site on an unpatched PHP version can be broken into even if every plugin is current.
Example: The logs show the first bad file appeared the day after a known flaw in a forms plugin went public. That plugin is the entry point.
Quick check: You can name the entry point in one sentence. If you cannot, plan for a full restore or rebuild, not a quick clean.
5. Clean or restore, then update everything
A clean backup from before the first bad file change is usually the faster, safer route. Without one, the files and database must be cleaned by hand or with a scanner. Either way, update the CMS, plugins, themes and PHP, and delete what you do not use.
| Option | Typical price | Speed | Best for |
|---|---|---|---|
| Restore from your own clean backup | Your time only | Hours, if the backup is recent | Sites with tested, off-host backups |
| Host's paid cleanup service | Varies by host | Varies | Simple infections on one site |
| Sucuri Basic Platform | $229 a year | 30-hour malware removal target | Owners who want cleanup plus monitoring |
| Sucuri Business Platform | $549 a year | 6-hour malware removal target | Sites where downtime costs real money |
| 3xRevenue website rescue | From $2,400 fixed price | Scoped per site | Repeat hacks, no backups or a move to a new platform |
Source: Sucuri website security platform pricing page and 3xRevenue Build page, checked October 30, 2026. Sucuri calls its response times estimates.
Run a free website health check
Quick check: After the restore or cleanup, search your files for code you do not recognize. Then list all admin users again.
6. Change the passwords again and rescan
Change every password again, since surviving code may have captured the first new set. Then rescan, recheck users and bring the site back online.
Quick check: Two clean scans a week apart, with no new admin users, are a good sign.
7. Request a Google review and tell the right people
If Google flagged your site, open the Security Issues report in Search Console. Fix every listed issue on every page, then select Request Review.
Google's Security Issues report help page says a review can take "from a few days to a few weeks." Resubmitting while a request is pending can make it longer.
If customer data or a payment page was involved, tell your payment processor and talk to a lawyer. The FTC notes that all 50 states have breach notification laws. Its data breach response guide for business walks through who to contact.
Quick check: You have a written note of what happened, what was exposed, what you fixed and who you told.
Which hack do you have?
Most likely malware or SEO spam, which together made up 76.7% of 2025 detections. Match what you see to the table below.
| Type of infection | Share of 2025 detections | What you usually see |
|---|---|---|
| Malware | 41.5% | Host warnings, browser warnings, fake update pop-ups |
| SEO spam | 35.2% | Spam pages or foreign-language titles in Google results |
| Malicious redirects | 21.7% | Visitors, often on phones, sent to other sites |
| Unwanted ads | 1.1% | Pop-ups or ads you did not add |
| Defacement | 0.5% | Your homepage replaced with a message |
Source: GoDaddy Annual Cybersecurity Report, published June 16, 2026, covering 2025 scans.
SEO spam and redirects often hide from logged-in admins. Check your site the way a stranger would.
Who controls your website?
You need your own login to 6 layers, from the domain to Search Console. Many hacks drag on because the owner cannot get into one key account.
| Layer | What to confirm | Why it matters in a hack |
|---|---|---|
| Domain registrar | The account is in your company name and email | You can move the site or fix DNS without waiting on anyone |
| DNS | You can log in and see every record | Attackers sometimes change records to hijack email or traffic |
| Hosting | You have the main login, not a sub-user | You can take the site offline and pull logs |
| Site admin | You have your own admin account | You can remove rogue users |
| Backups | Copies are stored off the host and were test-restored | A restore is the fastest clean path |
| Search Console | You are a verified owner | You can see warnings and request a review |
Source: ICANN domain name holder FAQs on registrant rights, Google Search Console Help, and 3xRevenue's own rescue checklist.
ICANN says your registrar must give you your domain's transfer code within five calendar days of a request. Rebuilding anyway? Our Webflow vs WordPress vs Framer comparison explains which platforms need the least patching.
What 10 days offline costs a local plumber
Example: these numbers are illustrative, not a real client. The lost leads cost far more than the cleanup.
Picture a 12-page WordPress site for a local plumbing company. It normally brings in 40 form and call leads a month. A forms plugin with a known flaw lets in a redirect script. The site is offline or flagged for 10 days.
Lost leads: 40 leads a month is about 1.3 a day, so 10 days costs about 13 leads. If the company wins 30% of leads at a $400 average job, that is about 4 jobs. That is roughly $1,560 in lost revenue.
Now compare the fix. With a tested backup, a restore could take an afternoon. A $229 a year security plan costs far less than those lost jobs.
The first 30 days after a hack, day by day
Days 1 to 5 are for recovery. Days 20 to 30 are for making sure it does not happen again.
- ☐ Day 1: Take the site offline, copy files and database, and start a written incident log.
- ☐ Day 1: Change all passwords from a clean device and turn on two-step login.
- ☐ Day 2: Confirm you control the domain, DNS, hosting, site admin and Search Console.
- ☐ Days 2 to 4: Find the entry point, then restore or clean the site.
- ☐ Day 4: Update the CMS, plugins, themes and PHP, and delete anything unused.
- ☐ Day 5: Change passwords again, rescan and bring the site back online.
- ☐ Day 5: Request a Google review if your site was flagged.
- ☐ Day 20: Set up daily off-host backups and test one restore.
- ☐ Day 30: Book a PHP upgrade if you run 8.2 or older, and choose who handles updates every month.
Common mistakes
- Cleaning before locking the doors. If the attacker still has a password or a backdoor file, they will be back within days.
- Restoring the newest backup without checking it. The newest backup may already contain the infection. Pick one from before the first bad file change.
- Letting someone else own the domain. If a former developer or agency holds the registrar login, you cannot act quickly when it counts.
FAQ
How do I know if my website was hacked?
Common signs are redirects, spam pages in Google results, new admin users and host or browser warnings. Check Google Search Console for a Security Issues alert, and view your site on a phone while logged out.
Should I take my hacked website offline?
Yes, in most cases. Taking it offline protects your visitors and stops the attacker from using your site against them. Use a maintenance page that returns a 503 status so search engines treat the outage as temporary.
How long does it take to recover a hacked website?
Restoring from a recent clean backup can take hours. A hand cleanup or rebuild can take days. If Google flagged the site, its review can add a few days to a few weeks after you request it.
Can my web host fix a hacked site for me?
Some hosts offer scanners or paid cleanup, and they can share logs. Most will not find the entry point or update your plugins, so reinfection is common.
How do I stop my website from getting hacked again?
Keep the CMS, plugins, themes and PHP current, and delete what you do not use. Use unique passwords with two-step login, and keep tested off-host backups. A firewall or a monthly care plan helps because many flaws have no patch yet when they go public.
Is a hacked website worth saving?
Usually yes, because most small business hacks are bots exploiting old software. Lock the doors, then clean, then ask Google for a review.
If you have no clean backup, keep getting reinfected or cannot reach a key account, get help. A scoped rescue usually costs less than a week of learning under pressure.
Get your site back, and keep it running
We fix hacked, slow or stranded sites, or move them to a stack you control. The fixed price is agreed in writing first. See how our website build and rescue service works, or start a project today.
Related: Website rescue | Website maintenance | Website in 7 days | Free website health check