Key takeaways
- Not every hack is visible. Spam pages and redirects often show only to some visitors.
- First lock things down: change passwords, then take a copy of the site as it is.
- Check with your host, and scan your own computer too. Logins are sometimes stolen from there.
- Clean it, update everything, then change the passwords again.
- Only ask Google to review your site once it’s really clean. Google also suggests a professional for tricky cases.
What should you do first if your website has been hacked?
Stay calm, write down what you’re seeing and when, then lock the doors. Change every password that touches the site, and tell your host. Take a copy of the site as it is before you clean anything. The steps below follow WordPress.org’s own guide for hacked sites and Google’s advice, so they suit most WordPress websites.
Say an electrician in Aspley rings you. A customer got a pop-up on your website and asked if you’d been hacked. You open the site and it looks fine. It might still be hacked. That’s the tricky part.
How to tell if you’ve been hacked
WordPress.org lists these as clear signs:
- Google, Bing or another search engine has blacklisted your site.
- Your host has disabled it.
- It’s been flagged for spreading malware, or visitors say their antivirus is flagging it.
- You’re told your site is being used to attack other sites.
- Things happen that you didn’t do, like new users appearing.
- You can see the damage when you open the site.
Google also says hackers can add hidden text or links to your pages, add new spam pages, or inject code that sends some visitors somewhere else depending on how they arrived or what device they use. So you might never see it yourself while your customers do.
Check Google Search Console. Open the Security Issues report, which lists problems Google has found. Google also notes that some hackers change email settings to hide alerts, so make sure alerts are reaching you.
The first hour, in order
- Write it down. What you’re seeing, what time you noticed, and anything you changed lately, like a new plugin or theme. It helps whoever fixes it.
- Ring your host. On shared hosting the hack may affect more than your site. Hosts can sometimes confirm what happened.
- Scan your own computer. WordPress.org says attackers often use malware on the owner’s computer to steal logins, so run a full scan before you type any new passwords.
- Change your passwords. Start with WordPress admins, then hosting, FTP/SFTP and the database. WordPress.org says this covers every user who has access, and suggests two-factor login.
- Log everyone out. Replace the secret keys in your wp-config.php file, which signs out anyone still logged in.
- Take a copy of the site as it is, even though it’s infected. If something goes wrong in the clean-up, you’ll have it to refer to.
Cleaning it up
WordPress.org calls finding and removing the hack the most daunting part, and it depends on how comfortable you are working with files and servers. Google’s advice is to take the site offline, find and clean the affected pages, and secure it before it goes back up. It also says many attacks are sophisticated and recommends a reliable professional.
What the cleaning usually involves:
- A clean backup. If you have one from before the hack, restoring it can be simpler than cleaning by hand. You still need to find how they got in.
- Reinstalling WordPress files. WordPress.org says you can safely replace the wp-admin and wp-includes folders, using the same version your site runs. Do it by file transfer, because the reinstall option inside WordPress often only overwrites existing files, and hacks often add new ones.
- Checking plugins, themes and users. Look for anything you don’t recognise, especially new admin users.
- Checking key files. WordPress.org says the .htaccess file is one of the most commonly changed, and that index.php, header.php, footer.php and your theme’s functions file are high-value targets.
When it’s clean, update WordPress, your plugins and your theme, then change the passwords again. WordPress.org says to change them after you’re sure the site is clean, not only when you find the hack.
Clearing a Google warning
If Google has flagged your site, fix it first. Google warns that asking for a review before the problem is really fixed only prolongs the flag. When you’re ready, go to the Security Issues report in Search Console, choose Request a review, and briefly say what you did for each issue. For example, “I removed the spam pages and updated an out-of-date plugin.”
Google says reviews for malware take a few days. Reviews for sites hacked with spam can take up to several weeks.
Check your email too
A hacked website can also be used to send spam. WordPress.org warns that it can get the server’s address blacklisted for email. If your business email goes through the same server, you may notice your messages landing in spam. See why business emails go to spam and how to fix it.
In Australia you can report a hack to the government through ReportCyber at cyber.gov.au. If customer details may have been taken, get advice on whether you have to tell anyone.
Stopping it happening again
- Keep WordPress, plugins and your theme updated. WordPress.org says older versions are more prone to hacks than newer ones.
- Use long, unique passwords and two-factor login, and give each person their own account.
- Take regular backups, and know where they’re stored. A recent backup is the quickest way back.
- Remove people who no longer need access.
- Find out how they got in. If nobody works that out, they may be able to do it again.
Keeping software updated and backed up is what our website care plans do. Updates, daily backups and health checks run every day, and every change is logged. Here’s what website maintenance involves.
Questions people ask
How do I know if my website has been hacked?
Look for warnings from Google or your host, new users you didn’t add, or visitors reporting pop-ups or redirects. Also check the Security Issues report in Google Search Console, because some hacks don’t show to you.
Can I fix a hacked website myself?
Sometimes, if you’re comfortable with files and servers and you have a clean backup. Google recommends a reliable professional for tougher cases, because many attacks are sophisticated.
How long does Google take to remove a hacked warning?
Google says reviews for malware take a few days, and reviews for sites hacked with spam can take up to several weeks. Only ask once the site is properly cleaned.
Should I restore from a backup?
If you have one from before the hack, it’s a good starting point. You still need to update everything and change your passwords, or the same hole can be used again.
Not sure where your site stands? Ask for a free website check and we’ll tell you what we can see. If you want it kept up to date from now on, have a look at our website care plans.