My Website Was Hacked — Now What? A Step-by-Step Recovery Plan

You check your website and something is wrong. Maybe your homepage is defaced with a message you did not write. Maybe Google is showing a "This site may be hacked" warning in search results. Maybe your hosting provider sent you a malware alert. Or maybe customers are reporting that your site is redirecting them to a suspicious pharmacy website.

Whatever the symptoms, the reality is the same: your website has been compromised. The good news is that most hacked websites can be recovered, often within a few hours. The key is to act methodically, not emotionally. Here is your step-by-step recovery plan.

Step 1: Do Not Panic, but Act Immediately

Time matters. Every minute your site remains compromised, it could be:

• Stealing customer data (credentials, payment info, personal details)
• Sending spam emails from your domain (damaging your email reputation)
• Distributing malware to your visitors
• Getting your domain blacklisted by Google and antivirus providers
• Being used as part of a botnet to attack other sites

Do not try to fix things randomly. Follow this guide in order.

Step 2: Take Your Site Offline

The first priority is stopping the damage. Put your site into maintenance mode or take it offline entirely:

• Enable maintenance mode. If you can still access your CMS dashboard, enable maintenance mode to display a "temporarily unavailable" page to visitors while keeping the backend accessible for cleanup.
• Password-protect the entire site. In cPanel, use Directory Privacy to add HTTP authentication to your web root. This blocks all public access while you work.
• Contact your hosting provider. Notify them immediately. They may be able to isolate your account to prevent the compromise from spreading, and they can provide server logs and technical assistance.

Step 3: Document Everything

Before you start cleaning, document the current state. This is critical for understanding how the breach happened and preventing a recurrence.

• Take screenshots of any defacement, error messages, or suspicious behavior.
• Note the date and time you discovered the issue, and when the site last appeared normal.
• Save copies of any malware notification emails from Google, your host, or antivirus services.
• Download a full copy of the compromised site (files and database) before cleaning. This "dirty" copy is evidence and may help identify the attack vector.
• Check your server access logs for suspicious activity (unfamiliar IP addresses, unusual POST requests, access to files that should not be publicly accessible).

Step 4: Change All Passwords

Assume every password has been compromised. Change all of the following immediately, using strong, unique passwords for each:

1. Hosting account password (cPanel, hosting provider login)
2. FTP/SFTP passwords for all users
3. Database passwords (MySQL user passwords)
4. CMS admin passwords (WordPress, Joomla, etc.)
5. CMS database connection password (in wp-config.php or equivalent)
6. Email account passwords for all addresses on the domain
7. SSH keys (if you use SSH access, revoke old keys and generate new ones)
8. API keys and tokens for any connected services (payment gateways, email services, analytics)

After changing the database password, update the connection string in your CMS configuration file (for WordPress, update DB_PASSWORD in wp-config.php). Also regenerate your WordPress security keys and salts — you can generate new ones at api.wordpress.org/secret-key/1.1/salt/.

Step 5: Identify the Hack Type

Understanding what happened helps you clean effectively and prevent it from happening again. Common hack types include:

Step 6: Scan for Malware

Run multiple scans to identify all infected files. A single scanner may not catch everything.

Free Online Scanners

• Sucuri SiteCheck (sitecheck.sucuri.net) — Checks for malware, blacklisting, errors, and outdated software.
• Google Safe Browsing (transparencyreport.google.com) — Shows whether Google has flagged your site as dangerous.
• VirusTotal (virustotal.com) — Scans your URL against 70+ security vendors.

Server-Side Scanners

• Wordfence (WordPress) — Deep server-side scan that checks all files against known clean versions and identifies modified core files, backdoors, and malicious code.
• ImunifyAV — Server-level scanner available through cPanel on many hosting providers. Scans all files for known malware signatures.
• ClamAV — Open-source antivirus for Linux servers. Run from the command line with clamscan -r /home/username/public_html.
• Maldet (Linux Malware Detect) — Specifically designed for shared hosting environments. Detects PHP backdoors, spam mailers, and web shells.

Step 7: Clean the Infection

Option A: Restore from a Clean Backup (Fastest)

If you have a recent backup from before the infection started, restoring it is the fastest and most reliable recovery method:

1. Identify the date the infection began (check file modification dates and server logs).
2. Restore a backup from before that date.
3. After restoration, immediately update all CMS software, plugins, and themes.
4. Change all passwords (you should have done this in Step 4).
5. Run a malware scan to confirm the restored backup is clean.

This is why maintaining proper backup strategies is so important. Without backups, you are left with manual cleanup.

Option B: Manual Cleanup

If you do not have a clean backup, you will need to manually remove the malware:

1. Replace core CMS files. Download a fresh copy of your CMS (WordPress, Joomla, etc.) from the official website and replace all core files. Do not overwrite wp-config.php or your wp-content directory.
2. Check the .htaccess file. Compare it against the default for your CMS. Hackers commonly inject redirects here. Replace it with a clean version.
3. Review and clean the wp-content directory. Check each plugin and theme folder for files that do not belong. Common malware file names include wp-tmp.php, wp-vcd.php, class-wp.php, and random alphanumeric filenames.
4. Delete inactive themes and plugins. Remove any themes or plugins you are not actively using. Even deactivated plugins can contain exploitable vulnerabilities.
5. Check the database. Look for suspicious content in post tables, option tables, and user tables. Check for admin accounts you did not create. In WordPress, check wp_options for suspicious entries in siteurl, home, active_plugins, and template.
6. Look for backdoors. Search your files for common backdoor indicators: eval(, base64_decode(, gzinflate(, str_rot13(, preg_replace with the /e modifier, assert(, and system(. Not all instances are malicious (some legitimate plugins use these functions), but each one should be investigated.

Option C: Professional Malware Removal

If manual cleanup feels overwhelming or if the infection keeps coming back, consider a professional service:

• Sucuri: $199.99/year includes unlimited malware removal, a WAF, and continuous monitoring.
• Wordfence Care: $490/year includes hands-on site cleaning, security audit, and ongoing monitoring.
• MalCare: $99/year includes one-click malware removal and a firewall.

Step 8: Remove Blacklist Warnings

If Google, antivirus providers, or browsers have flagged your site, you need to request a review after cleaning:

1. Google Search Console: Go to Security & Manual Actions → Security Issues. If Google has flagged your site, you will see details here. After cleaning, click "Request a Review." Google typically reviews within 72 hours.
2. Google Safe Browsing: If your site shows a red warning page in Chrome, the Search Console review process will resolve this.
3. Antivirus blacklists: Check your domain on VirusTotal. If any vendors flag it, visit their respective websites to request removal (most have a false positive/review process).
4. Email blacklists: If your server was used to send spam, your IP may be blacklisted by email providers. Check at mxtoolbox.com/blacklists.aspx and follow each blacklist's removal process.

Step 9: Harden Your Site Against Future Attacks

Recovering from a hack means nothing if the same vulnerability is still open. Implement these security measures immediately after recovery:

• Update everything. CMS core, all plugins, all themes, PHP version, and server software. Outdated software is the number one attack vector.
• Enable two-factor authentication on all admin accounts, hosting accounts, and email accounts.
• Install a Web Application Firewall. A WAF blocks known attack patterns before they reach your application.
• Set up automated daily backups with off-site storage. Follow the 3-2-1 backup rule.
• Install a security plugin. Wordfence or Sucuri Security for WordPress provides firewall rules, malware scanning, and login protection.
• Review file permissions. Directories should be 755, files should be 644, and sensitive config files should be 600.
• Limit login attempts and change the default admin URL.
• Set up security monitoring. Configure alerts for file changes, failed login attempts, and new user registrations.

Step 10: Communicate with Stakeholders

Depending on the nature of the breach, you may need to notify affected parties:

• Customers: If personal data or payment information was potentially exposed, notify affected customers promptly. Be transparent about what happened, what data was affected, and what steps you have taken.
• Legal/regulatory bodies: GDPR requires notification within 72 hours of discovering a breach that affects personal data. CCPA, HIPAA, and other regulations have their own notification requirements.
• Payment processor: If payment data was potentially compromised, notify your payment processor (Stripe, PayPal, etc.) immediately. They can monitor for fraudulent activity and may require a PCI DSS compliance review.
• Your team: Ensure everyone with access to the site knows what happened and follows the new security procedures.

"The way you handle a security breach defines your brand's trustworthiness. Transparency, swift action, and genuine improvement in security practices can actually strengthen customer trust in the long run."

Recovery Timeline

Frequently Asked Questions

How do I know if my website has been hacked?

Common signs include: unexpected redirects, new pages or content you did not create, Google Search Console security warnings, dramatically increased server resource usage, spam emails being sent from your domain, unknown admin accounts in your CMS, modified files (check file dates), and customer reports of suspicious behavior. Use Sucuri SiteCheck or Google Safe Browsing to scan your site if you suspect a breach.

Can a hacked website be fully recovered?

In the vast majority of cases, yes. With a clean backup, recovery takes hours. Without a backup, manual cleanup usually works but may take longer and requires more technical expertise. The only scenario where recovery is truly difficult is if the attacker gained access to your domain registrar and transferred your domain — which is why securing your registrar with 2FA is critical.

Will I lose my Google rankings after a hack?

Temporarily, possibly. If Google flags your site or if it is offline during cleanup, you may see ranking drops. However, once the site is clean and the blacklist warning is removed, rankings typically recover within 2–4 weeks. The sooner you detect and fix the issue, the less impact it has on your SEO.

Should I rebuild my website from scratch after a hack?

Usually not necessary. A thorough cleanup and hardening is sufficient for most hacks. However, if the infection is deeply embedded, keeps recurring despite cleanup, or if you were already planning a site redesign, a fresh build on a secure foundation can be the most efficient path forward.

How much does professional hack recovery cost?

Professional malware removal services range from $100 to $500 for a one-time cleanup. Annual plans with ongoing protection (Sucuri at $199/year, Wordfence Care at $490/year) include unlimited cleanups plus continuous monitoring and prevention. For most small businesses, the annual plan is the better value.