My website has been hacked: what to do

A hack shows itself in one of five ways.

• A warning label on the result in Google, or a full-page warning in the browser. Google’s help says pages affected by a security issue can appear with either.
• Visitors arriving from Google are sent to a different website.
• A search for site: followed by your domain lists pages you never wrote.
• The Security issues report in Search Console shows a finding.
• The host has suspended the account.

1. Tell the host. Hosts see this often, and many will help contain it.
2. Take the site offline or put it behind a holding page, so that visitors are not harmed.
3. Change every password: hosting, the website’s administrator accounts, file transfer and the database.
4. Leave the files as they are for now. They are the evidence of how the attacker got in.
5. Find the most recent backup taken before the hack began.

Google’s guide for hacked sites names seven steps, in this order.

1. Build a support team.
2. Quarantine your site.
3. Use Search Console.
4. Assess the damage.
5. Identify the vulnerability.
6. Clean and maintain your site.
7. Request a review.

Restoring a backup from before the hack is the fastest route to a clean site. A restore on its own puts back the weakness as well: the outdated plugin, the weak password or the abandoned theme that let the attacker in. Update everything and close the hole before the site goes back online.

Without a clean backup, the site has to be cleaned by hand: every changed file, every unknown user account, every injected page.

The Security issues report in Search Console lists what Google found, under three headings: hacked content, malware and unwanted software, and social engineering. When the whole site is clean, select “Request Review” in the report and describe what was fixed.

Google states that fixing only some pages does not earn a partial return to search results. Most reviews take several days or weeks.

Four habits prevent most repeat attacks.

• Updates applied as they are released, for the platform, the theme and every plugin.
• Unused plugins, themes and user accounts removed.
• A unique password and two-step verification on every account.
• Backups taken on a schedule and stored away from the website’s own server.

A browser warning that says “Not secure” is a different matter from a hack. Our guide to why a website says not secure covers that one.