Your site’s been hacked. Here’s what to do right now.
Take a breath. You don’t have to fix everything tonight. The steps below are safe to take in order, and none of them needs technical knowledge.
Don’t delete the site or restore an old backup yet. Take a copy of it as it is now, then work through the steps.
Rather hand it to us? Start a recovery and an engineer picks up your case. We work by email, so you can also write to us at hello@unhackmysite.net.
Safe first steps, in order
Pause before you delete or restore anything
Deleting the site or rolling back to an old backup can feel like the quickest fix. But it can wipe the clues that show how they got in, and an old backup may already contain the problem.
Take a copy of the site as it is now
Download the site’s files and database, or ask your host for a snapshot. Label it as the hacked copy and keep it apart from your clean backups. How you do this depends on your host: many have a backup or snapshot option in their control panel, and if the site has been suspended, ask them for a copy.
Change your passwords from a clean device
Use a computer or phone you trust. Change the passwords for your hosting account, every WordPress administrator, FTP or SFTP, and the database. The database password is also stored in the site’s wp-config.php file, so change both together or ask your host to help. Turn on two-step sign-in wherever it’s offered.
Check who has admin access
In WordPress, open Users and filter by Administrator. Do the same for the users on your hosting account if it has them. Write down the username and email of any account you don’t recognise, then remove it, or change its role to Subscriber so it can’t manage the site. Changing its password isn’t enough: whoever controls its email address can reset it. If you’re not sure about a hosting account user, ask your host to disable it.
Tell your host
Your host may already know, and may have taken the site offline. Ask what they’ve seen, whether they keep backups from before the hack, and what they need from you to bring the site back. What they can do differs from host to host.
Check Google Search Console for security warnings
If the site is in Search Console, open Security & Manual Actions, then Security issues. It shows whether Google has flagged the site, and it’s where you ask Google to review the site once it’s clean. If you don’t use Search Console yet, you can add and verify the site now.
Write down what you see, and when
Note when you first noticed, what you or your visitors saw (a redirect, a browser warning, pages you didn’t make), any emails from your host or Google, and anything you’ve changed since. Screenshots help. It gives whoever cleans the site a head start on what happened.
A few things that make it harder
They feel helpful in the moment. Leave them for now.
Don’t pay anyone who says they hacked you
If someone gets in touch claiming they did it, or offering to fix it out of the blue, don’t pay them and don’t reply.
Don’t install cleaner plugins in a hurry
A plugin from a source you don’t know is one more piece of code with full access to your site, and a quick scan can miss how they got in.
Don’t wipe anything before you have a copy
Deleting files, logs or users before step 2 removes the evidence of what happened and how.
Don’t sign in from a device you’re unsure of
If a computer might be infected, a new password typed on it may not stay private.
Don’t stop once the symptom goes away
A redirect or warning can come and go while the way back in stays open. The site isn’t clean until that’s found and closed.
Hacked right now?
Start a recovery and an engineer will pick it up, day or night. Or email us at hello@unhackmysite.net.