Website hacked? What to do in the first hour

If your website has been hacked, the first hour decides how long the clean-up takes. Write down what you see, take the site offline properly, tell your host, and copy the files, database and logs before you change anything. Then change every password from a computer you trust, restore from a backup taken before the hack, and find out how the attacker got in. This article goes through those steps in order, for any website and with notes for WordPress.

How you know it has happened

The signs are usually one of these:

• Google or your browser shows a warning such as "This site may be hacked" or a red malware page.
• Visitors say their antivirus blocked your site, or they were sent to a different site.
• Pages show content you did not put there: a defacement, adverts for pills or casinos, or hidden links that only search engines see.
• An administrator account appears that nobody created.
• Your host tells you the site has been suspended or is sending spam.

First, write it down

Before you touch anything, note what you saw, when you noticed it (with the time zone), and what changed recently, such as a new plugin, a theme edit or a new developer login. WordPress's own guide to hacked sites starts here, because these notes become the starting point of your incident record. They help whoever cleans the site, and they help you if you have to report the incident later.

The UK National Cyber Security Centre (NCSC) adds a caution worth keeping in mind: over-reacting can cause more damage than the incident itself. Work through the steps; do not start deleting files.

Stop the damage spreading

A hacked site can infect visitors, steal what they type, or send them to fraud. Take it offline.

The best way is to show visitors a plain maintenance page served from somewhere clean, with the "503 Service Unavailable" status that tells search engines the outage is temporary. Google's guidance for hacked sites points out that an error page served by the compromised site itself does not protect visitors, and that robots.txt only stops search engines, not people.

Tell your host now

Contact your host early. On shared hosting, an attack on one site can affect the server, so the host needs to know. The host can also help put the site behind a maintenance page, tell you what backups exist and from which dates, and give you the server's access and error logs.

If you host with Noiz, open a ticket from the client area and say what you have seen and when.

Copy everything before you clean

This step is the one most often skipped, and the one that matters most later. Before you delete, restore or update anything:

1. Take a full backup of the site as it is now, infected files and all. Our help article on generating a full backup in Plesk shows how.
2. Export the database separately. See exporting a database backup in Plesk.
3. Download the access and error logs. They record which addresses requested which pages, and when.
4. Keep the copies off the server, on your own storage.

WordPress, Google and the US cybersecurity agency CISA all advise keeping a copy of the compromised system before rebuilding. It shows how the attacker got in, when it started, and what they could reach. Google also warns that attackers sometimes alter logs, which is another reason to save them early.

Check the computer you manage the site from

Many website hacks begin on the owner's own computer. Malware there copies saved passwords for the hosting panel, FTP and the website's admin area, and sends them to criminals. If that is how the attacker got in, changing passwords on the same computer hands them the new ones.

Scan every computer that has been used to log in to the site, and change passwords from one you trust. Our article on infostealer malware explains how these programs work and how to clean a computer properly.

Change every password and end every session

From a clean device, change the password for every way into the site:

• The hosting control panel and the client area. See changing your Plesk account password.
• Every FTP or SFTP account. See changing an FTP password in Plesk.
• The database user. See changing your WordPress database password.
• Every administrator account in the website, and ideally every user.
• Mailboxes on the same domain, if their passwords were saved on the same computer or reused.

A new password does not always end sessions that are already open. In WordPress:

• Replace the security keys in wp-config.php. This logs every user out.
• Use Log Out Everywhere Else on your profile page.
• Revoke application passwords on each user's profile. They are separate from the login password, so changing the password leaves them working.

Then look at the list of users and remove any you do not recognise. Turn on two-factor authentication for every administrator; our help article covers two-factor authentication in WordPress.

Restore from a backup taken before the hack, then update

Restoring is usually faster and more reliable than hunting through files by hand. The hard part is choosing the backup. Your notes and the logs show roughly when the compromise began, so pick a backup from before that date.

A restore alone puts back the same weakness the attacker used. So straight afterwards:

• Update the website software, every plugin and every theme.
• Remove plugins and themes you do not use. An inactive plugin's files are still on the server.
• Replace any plugin that is no longer maintained. Our guide on when to replace an outdated or abandoned plugin helps you decide.
• Change the passwords once more now that the site is clean.

Find out how they got in

Google lists the common causes: an infected administrator computer, weak or reused passwords, and outdated software. For WordPress, outdated plugins dominate. The security company Patchstack counted more than 11,000 new vulnerabilities in the WordPress ecosystem in 2025, 91% of them in plugins, and found that nearly half had no fix available when they were disclosed. Our WordPress security checklist covers the habits that close these gaps.

Clear Google's warning

If Google flagged the site, sign in to Google Search Console:

1. Check Users and permissions and remove any owner or user you did not add.
2. Open the Security Issues report, which lists the problem and sample pages.
3. When the whole site is clean, select Request Review and describe what happened and what you fixed.

Google says reviews take from a few days to a few weeks. Send one request and wait for the answer. Resubmitting can slow the review down.

If personal information was involved: POPIA section 22

If your site holds customer details, such as contact form messages, orders or member accounts, the hack may have exposed personal information. Section 22 of the Protection of Personal Information Act (POPIA) says that where there are reasonable grounds to believe personal information was accessed by an unauthorised person, you must notify the Information Regulator and the people affected as soon as reasonably possible. Since 1 April 2025, the Regulator requires these reports through its eServices portal. The evidence you saved earlier is what lets you report accurately. Noiz is not a law firm; take advice on whether your incident must be reported.

Where Noiz fits

Every Noiz shared hosting plan includes a weekly backup kept off site, and you can ask for a restore by opening a ticket. If you would rather not face this alone next time, WordPress Care includes hack fix and recovery: triage, a scan, removal of malicious files, and a clean restore from the most recent usable backup. It also keeps WordPress, themes and plugins updated every week with a restore point taken first, and patches known vulnerabilities as fixes are released, which closes the most common way in. If your site is hacked today, open a ticket and tell us what you see.

Sources

Checked 19 October 2026.

WordPress

• WordPress.org, FAQ My site was hacked
• WordPress Advanced Administration, Hardening WordPress
• WordPress developer documentation, wp-config.php security keys
• WordPress.org, Users Your Profile screen
• Make WordPress Core, Application passwords integration guide

Google

• Google, Quarantine your site
• Google, Identify the vulnerability
• Google, Clean and maintain your site
• Google Search Console Help, Security Issues report

Incident guidance

• NCSC, 10 Steps: incident management
• NCSC, Small business guide: identify what's happening
• CISA, #StopRansomware guide
• CISA, Cyber guidance for small businesses
• Patchstack, State of WordPress Security in 2026

Law

• Protection of Personal Information Act 4 of 2013 (Government Gazette 37067)
• Information Regulator, media statement on reporting security compromises through eServices (7 April 2025)

Noiz

• WordPress Care
• Shared hosting
• Help articles linked in the text, on docs.noiz.ie

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.