What to Do When Your Website Gets Hacked
A hacked website can be scary, but staying calm and acting quickly will help you recover faster and minimize damage. Here’s a step-by-step guide to follow if your site has been compromised.
1. Don’t Panic – Take the Site Offline
The first thing you should do is limit further damage. Put your site in maintenance mode or temporarily take it offline. This prevents hackers from doing more harm and keeps visitors safe from malware.
2. Change All Passwords
Update your admin, hosting, FTP, database, and email passwords immediately. Use strong, unique passwords and enable two-factor authentication (2FA) wherever possible.
3. Scan Your Website for Malware
Use a security plugin or an online scanner (like Wordfence, Sucuri, or MalCare) to detect malicious code, suspicious files, or backdoors left by hackers.
4. Check User Accounts
Review all user accounts in WordPress (or your CMS). Delete any unknown or suspicious accounts that may have been created by the attacker.
5. Restore from Backup
If you have a clean backup, restore your website to the latest safe version. Make sure the backup is not infected before restoring.
6. Clean and Secure Files
- Remove suspicious files and scripts.
- Reinstall WordPress core, plugins, and themes from official sources.
- Update everything to the latest version.
7. Update Server & Hosting Security
- Scan your server for vulnerabilities.
- Ask your hosting provider if they can help check logs and block malicious IPs.
- Apply security patches on your hosting account.
8. Submit to Google for Review
If your website was blacklisted, request a malware review in Google Search Console after cleaning it. This helps remove warnings like “This site may be hacked.”
9. Harden Your Website for the Future
- Install a trusted security plugin (Wordfence, iThemes Security, etc.).
- Limit login attempts and block suspicious IPs.
- Use SSL (HTTPS).
- Schedule regular backups and keep them offsite.
10. Get Professional Help (If Needed)
Sometimes cleaning a hacked site requires expert knowledge. If you’re unsure, contact a WordPress security expert or Techvila Support to fix it properly.
👉 Final Tip: Prevention is better than cure. Regular updates, backups, and security monitoring can save you from future headaches.