Website hacked? What to do in the first hour
Don't panic, and don't delete anything yet. Here's the order to do things in, written for owners rather than IT people.
The plan
- Don’t panic, and don’t delete anything yet. You may need the evidence to work out how they got in.
- From a clean device, change passwords for email first, then domain, hosting and website. Turn on two-step login as you go. If your laptop might be infected, use a different device. (Here’s why.)
- Call your host. Ask them to take the site offline or put up a holding page if visitors are being harmed.
- Get it cleaned properly, including backdoors and hidden admin users, or it will come back. Restoring an old backup can restore the hole too.
- Ask Google for a review in Search Console once it’s clean, to remove any warning.
- Check your legal duties if customer details may have been exposed, and tell your insurer. UK GDPR, for example, expects serious breaches reported to the ICO within 72 hours.
- Report it (see below).
- Fix the cause. Work out how they got in, and close that door for good.
Where to report it
| Country | Where |
|---|---|
| Australia | ReportCyber |
| United Kingdom | The national police fraud and cybercrime reporting service (in Scotland, Police Scotland on 101) |
| United States | FBI IC3 |
| Canada | Canadian Anti-Fraud Centre |
| New Zealand | Own Your Online |
After the clean-up
Most hacked small sites are hacked through a plugin, a stolen password or an old admin account. Once you’re clean, work through the easy safety check so the same door doesn’t open twice.
If you’re tired of looking after the machinery, Hedgehog can move your site onto static hosting with no plugins, no database and no login page. Ask for a free preview and we’ll tell you honestly whether it suits your site.
Common questions
What should I do first if my website is hacked?
Don't delete anything. From a clean device, change the passwords for your email first, then domain, hosting and website, and turn on two-step login. Then call your host and ask them to take the site offline or put up a holding page if visitors are being harmed.
Will restoring a backup fix a hacked website?
Not on its own. A backup can contain the same hole or backdoor, so the site may be hacked again within weeks. The cause has to be found and closed, and hidden admin users removed.
How do I remove a Google warning from my website?
Once the site is fully clean, request a review in Google Search Console. Google usually reviews it within a few days.
Where do I report a hacked website?
ReportCyber in Australia, the police fraud reporting service in the UK, IC3 in the US, the Canadian Anti-Fraud Centre in Canada, and Own Your Online in New Zealand.
Want all of this in one place?
Our free plain-English guide covers every topic in this library, with five easy wins you can do today. We'll email it to you.
Email me the free guide