Website Hacked? What to Do in the First Hour

If you think your website has been hacked, do these in order: take a copy of what is there, ring your host, change your passwords from a device you trust, get the site cleaned or put back from a clean backup, and only then ask Google to review it. Do not start deleting things in a panic. This guide is for the first hour after you find out, written for someone who does not look after the site's files themselves.

What should I do first if my website has been hacked?

Tell whoever hosts the site, and ask them to take a copy of the files and logs before anything is changed. Hosting is the company that keeps your site's files on a server, and it is the one party that can see what is actually there. Most hosts have a support line or chat for exactly this.

The copy matters because a hack leaves a trail. If the odd pages are deleted straight away, nobody can tell how the attacker got in, and the same way is usually still open. This is common practice among security people rather than a rule from a regulator, so treat it as sensible caution, not law.

Who do I ring, and what do I say?

It depends on how the site was built, and the answer is usually the company or person who can see the files. Work down this list and stop at the first one that applies:

• Your host, if you pay one. Start here whatever else is true. They can often isolate the site while it is sorted out.
• Whoever built or maintains the site. If you pay a freelancer or agency for upkeep, this is part of what you pay for. If nobody does, our guide to who owns your website explains how to find out who holds the keys.
• The builder's support team, if you used a hosted website builder. You cannot reach the files yourself, so they handle it. Change your account password first.

A message you can copy and send today:

"I think our website has been hacked. [Say what you saw: strange pages, a warning, a redirect, an email from Google.] Please take a copy of the files and logs before changing anything, tell me what you find and how it got in, and tell me whether you have a clean backup from before it happened. Please also tell me what else on the same account could be affected."

How do I know it is a hack and not something else?

You may not, and that is fine to say to your host. Signs that point to a hack are pages you never made, visitors sent to another site, a login you do not recognise, or a warning from Google. Google describes hacked content as content placed on your site without your permission, and its report splits it into malware, code injection, content injection and URL injection.

A small "Not secure" label next to the address is a different problem, covered in our guide to the 'Not secure' warning. If the whole page is blocked by a red warning, see what to do about 'Deceptive site ahead'.

Which passwords should I change, and from where?

Change every password that touches the site, and do it from a device you trust, not the one you suspect. That means your hosting account, your website login, your domain account, your email and anything the site connects to. Use a different password for each, and where a service offers two-step login, switch it on.

If one password was reused across several of these, change them all, because one stolen password then opens every door it fits. Do this after you have asked the host for the copy, so you do not lock them out of their own investigation.

Should I tell the authorities?

If an attack is happening now, the National Cyber Security Centre says to call its 24 hour line on 0300 123 2040, and that for a significant attack you should start by reporting it to them. For a defaced brochure site that is already over, your first call is still your host. If customers' personal details may have been exposed, that carries separate legal duties under data protection law, which is a question for the ICO's own guidance and, if the stakes are high, a professional.

How do I get the site clean and trusted again?

Restore from a clean backup if one exists from before the hack, or have the infected files removed, then close the way in by updating the software and the passwords. A backup taken after the hack just restores the problem, so ask your host which date they are restoring from. If you have no backup at all, say so plainly, because it changes the price and the time of the job.

Once everything is fixed, open the Security Issues report in Google Search Console and press Request Review. Google says to do this only when every listed issue is fixed on every page, and that asking too early can lengthen the next review or get you marked as a repeat offender. Its help page says a review for hacked content can take from a few days to a few weeks, so the warning may outlast the clean-up. Do not resubmit while one is pending.

What should you do next?

Send the message above and, while you wait, give customers another way to reach you: your phone number, your Google Business Profile or your social pages. For the longer view, how a small site gets broken into and what to keep in place, read whether your website is secure enough. If a move to a new host is on the cards, this guide to moving hosting covers what that involves. The wider picture is in fixing your website and getting found.

If you would rather have somebody else looking after hosting, security, backups and edits, ByRender's care plan is from £69 a month, after a setup from £495, and you only pay if you keep the site we build you for free. Send us your details and you can look round it first.

Frequently asked questions

Should I delete the strange pages myself?

Not yet. Deleting them removes the evidence of how someone got in, and a half-clean site can be re-infected from a file you missed. Ask whoever looks after the files to take a copy first, then clean everything in one go.

Do I have to tell my customers?

That depends on whether anything they gave you was exposed, and it is not a question this guide can settle for you. If your site collects names, emails or payments, ask your host or developer what the site could reach and read the data protection pages on the ICO website before you decide.

Will changing my passwords be enough?

Rarely on its own. A new password locks the door you know about, but a hacker often leaves a back door in the files. Change the passwords and have the files checked or restored from a clean copy.