Your website has been hacked: a calm, step-by-step recovery plan

Signs of a hacked website include visitors being redirected to strange sites, spam pages appearing in search results, unfamiliar admin users, or a browser warning that the site is dangerous. Act quickly, but methodically.

1. Contain

• Change the passwords for the hosting account, the website admin, FTP and the database.
• Put the site in maintenance mode if it is actively harming visitors.
• Tell your hosting provider; they may see the cause in server logs.

2. Preserve evidence

Take a copy of the infected files and database before cleaning. It helps to find out how the attacker got in and confirms what data may have been touched.

3. Find the entry point

The usual causes are an outdated plugin or theme, a stolen admin password, a nulled (pirated) plugin with a built-in backdoor, or an old forgotten installation on the same account. Check access logs around the time the problem started.

4. Clean or restore

• Restore from a clean backup taken before the infection, if you have one and know when the infection began.
• Or clean: reinstall the core software and plugins from official sources, remove unknown files, check the database for injected scripts and remove unknown users.

Then update everything to current versions.

5. Close the door

Fix the entry point you found. Remove unused plugins, themes and old sites. Turn on two-factor authentication for admins.

6. Recover your reputation

If search engines flagged the site, request a review in Google Search Console once it is clean. Check that your domain is not on email blocklists if the site was sending spam.

Prevention

Regular updates, strong unique passwords, daily backups kept off the server and a web application firewall stop the vast majority of attacks. Read WordPress security essentials for a fuller list.

How IDX helps

If your site on IDX hosting has been compromised, open a ticket straight away. Our engineers can help identify the cause and restore from backup, and our managed services team can take over ongoing security maintenance.