A customer messages you: "Your site is full of gambling ads." You open it and the homepage looks fine. Then on your phone it jumps to a strange page. Your stomach drops: the site has been hacked.
The first thing to know is that panic makes everything worse. The second is that the first 24 hours have a clear order of work, and you can follow it even without a technical background. This post is only about defense and recovery for your own website.
How to recognize it
A compromised site does not always show a giant "you have been hacked" banner. Attackers usually want you not to notice, so they can use your site for as long as possible. Common signs:
Pages redirect to unknown sites, especially for visitors coming from Google or on mobile. Google search results show strange titles, foreign-language text or ads you never wrote. The browser or Google warns that the site may be harmful. There is an admin account you did not create. Unfamiliar files sit in the web folder, or old files were modified recently. The site suddenly slows down and the server load rises without more visitors. Your hosting provider emails you about spam being sent from your server.
One subtle sign: the site looks normal to you but different to visitors. Some malware deliberately hides from a logged-in owner. So open the site in a private window and on your phone using mobile data, and do not trust only your own computer.
What to do in the first 24 hours
Hour one: isolate
The goal is to stop the damage from spreading. If the site can be closed temporarily, switch on a maintenance page or ask your host to block access for a while. For a shop, close checkout first, since customer details may be at risk.
Write down what you see before changing anything: screenshot the strange page, note the time, note the names of suspicious files. These notes help you find the cause later, and spare whoever helps you from guessing.
Do not wipe everything and reinstall right away. You would lose all the clues, and if the hole is still open, the attacker simply walks back in.
Hours two to six: change the keys
Change passwords in this order: hosting account, site admin account, database password, FTP or SSH account (the ways to log in and copy files), and finally the email address tied to the admin account. Use a long, different password for each. A password manager saves you from memorizing them.
Delete or lock every admin account you do not recognize. If the site uses secret keys (WordPress has its own set in the config file), generate new ones. That forces every current login session to sign in again, including the attacker's.
If two-step login is on, keep it. If not, turn it on right after changing passwords.
From hour six: restore a clean backup
If you have a backup from before the break-in, this is the fastest and most reliable path. Pick one that is old enough: after the last date you are sure the site was clean, before the first sign of trouble. A backup that is too recent may bring the malware back with it.
Before overwriting anything, keep the current infected copy somewhere separate and never run it. It is evidence for finding the cause. Then restore the clean copy on the isolated site, check it carefully, and reopen only after the hole is closed.
If you have no backup, someone with the right skills must clean the malware file by file. That is slow and easy to get wrong, which is exactly why I wrote Website Backups Done Right: The 3-2-1 Rule and Testing Your Restores.
Same day: find the weak spot
Restoring without knowing how the attacker got in often leads to a second break-in. Common causes: an old plugin or theme with an unpatched hole, a weak password or one leaked from another service, a personal computer infected with password-stealing software, or software installed from an unofficial source.
For a non-technical owner: update everything to the latest version, remove plugins and themes you do not use, and keep only things from official sources. Look at the server access log around the first sign to see who did what. If you have a technical person, ask them to do this step. For a systematic review of weaknesses, see Self-Check Your Website's Security with the OWASP Top 10 (2025).
Tell Google if the site is flagged
If Google shows a warning next to your site, use Google Search Console. The "Security issues" section tells you what Google found. After you clean up and patch, you submit a review request in that same section. The warning is lifted once Google checks and finds the site clean. This takes time, so do not wait until the last minute to send it.
Do not request a review before the cleanup is done. Repeated rejections only waste more time.
For those who write code
A few quick checks for a PHP site on Linux, for observation only, changing nothing:
# source files modified in the last 3 days
find /path/to/site -type f -name '*.php' -mtime -3 -ls
# functions commonly used by malware to hide code
grep -rIl --include='*.php' -E 'eval\(base64_decode|gzinflate\(base64' /path/to/site
The results are hints only, because some legitimate plugins use these functions too. Compare against the original from the official source before drawing conclusions. For WordPress, wp core verify-checksums compares core files with the official release.
Common mistakes
The scenario I see most: a site is hacked, the owner restores a backup quickly and happily reopens. A few days later it redirects again. The old plugin was never updated, so the attacker came back through the same door. Restoring without patching is like tidying a house while the door stays open.
A second mistake is changing only the site admin password and forgetting the database and FTP passwords. A third is deleting the infected copy at once and losing every clue.
What to do next
Once things are calm, set aside an afternoon to build lasting protection: turn on automatic updates for security fixes, enable two-step login, limit each account to the access it needs, and set up automatic backups. If you want someone to review and harden the site for you, get in touch. I will look at the state of your site first and only then tell you what to do.
