What to do first if your website is hacked

If you have just confirmed your website has been compromised, work through this in order rather than jumping to whichever step feels most urgent. The sequence matters: acting out of order can waste the evidence you need to stop it happening again, or bring a still-compromised site back online before it is actually safe to.

1. Take the site offline or into maintenance mode

A live, compromised site keeps doing damage for as long as it stays reachable — serving malware to visitors, sending spam, or feeding search engines content you did not write. Putting the site into maintenance mode or taking it offline entirely stops the bleeding while you work, and it does not need to be a permanent step.

2. Change every credential, immediately

Assume everything was potentially exposed and change it, in this order:

• Your control panel password. This is the account with the widest reach across your hosting, so secure it first.
• CMS admin passwords. Every administrator account, not just the one you normally use.
• Database password. Update it in both the database itself and wherever your site's configuration references it, or the site will stop connecting.
• FTP and SSH credentials. Anything that could have provided file-level access.

3. Find the most recent clean backup

Restoring from a backup taken before the compromise is almost always faster and more reliable than trying to identify and clean every affected file individually — a compromise often touches more files than are obvious from a manual look. Check the dates available and identify the most recent backup that predates when you believe the compromise started.

4. No clean backup? Clean it manually

Without a backup that predates the compromise, every file needs checking individually rather than trusted wholesale. How to scan your site for malware covers running a proper scan, and treat any file the scan flags, plus anything with a modification date matching the suspected compromise window, as needing removal or replacement from a known-good source.

5. Find out how it happened

This step is easy to skip when you are relieved the site is working again, and it is the single most important one. Common causes worth checking specifically:

• An outdated CMS, plugin or theme with a known, published vulnerability.
• A weak or reused password on an admin, FTP or database account.
• A file or folder left with overly permissive access — see how to set safe file permissions for what correct permissions actually look like.
• A vulnerable third-party form, upload feature, or plugin that accepts files from the public.

Restoring a clean backup without closing the actual weakness leaves the same door open, and it is common for a site cleaned this way to be compromised again within days through the exact same route.

6. Bring the site back online and watch it

Once you are confident the cause has been identified and fixed, restore public access. Keep watching more closely than usual over the following days and weeks — check for the same signs covered in how to tell whether your website has been hacked, since a determined attacker sometimes returns through a different route if the first one is now closed.

What this does not cover

If personal data, passwords, or payment details may have been exposed, notification obligations to affected people and to relevant regulators are a legal matter specific to your location and circumstances, and this guide does not substitute for proper legal advice on that question. If the compromise involved encrypted files and a ransom demand, do not pay it — restoring from a clean backup achieves the same result without confirming the account is worth targeting again. Recovering from ransomware on a website covers that situation specifically. And if at any point you are not confident carrying out these steps yourself, contact support rather than guessing on a live, compromised site.