On this page
- 01Signs your website has been hacked
- 02Hour 0: lock down, do not clean
- 03Hours 1 to 4: restore a clean copy
- 04Find the way in: plugin, password or hosting
- 05Hours 4 to 24: tell Google it is fixed
- 06Hours 24 to 72: the breach notice and the national CSIRT
- 07What a hack costs you, in time
- 08Why a static site is harder to break
Website hacked? Do these three things first, in this order: change the passwords of your hosting, your site admin and your email from a different device, take a copy of the site as it is now, and put the site in maintenance mode or ask your host to suspend it. Only then start looking for how it happened. Clean up first and you wipe the traces that show what the attacker can still reach.
This guide runs from the moment you notice to three days later: what to do each hour, who to tell, when the 72-hour breach notice under the GDPR applies, and how to get Google to show your site without a warning again. It is written for a business anywhere in Europe, with the authority to contact per country. If your site runs on WordPress, read is WordPress safe as well: it explains why the way in is nearly always a plugin.
Signs your website has been hacked
A hack is rarely a black screen with a skull. Most attackers want you not to notice, because your site is a free server for them.
| What you see | What is often behind it |
|---|---|
| Google shows "This site may be hacked" under your result | Spam pages in another language, often pharma or gambling |
| Phone visitors are redirected to another site | Code that only redirects mobile visitors coming from Google, so you never see it on your laptop |
| Your email suddenly lands in spam or bounces | Your server sends spam and your domain is on a blocklist |
| Unknown admin users or files in your hosting | A backdoor, so the attacker can return after your clean-up |
| The site is slow and your host reports high load | Your server is mining, mailing or attacking other sites |
A slow site can simply be a slow site; why WordPress is slow covers the usual causes. Email landing in spam more often has a DNS cause than a hack: check why your emails go to spam first.
The playbook from hour 0 to hour 72
- Hour 0Lock downHost, agency or authorityHost puts the site in maintenance or suspends it if it redirects or leaks.
- Hour 1Copy and restoreYouKeep a copy of the infected site. Find the date of the first strange change.Host, agency or authorityAgency restores the last clean backup and updates everything.
- Hour 4Close the holeYouHave unused plugins and accounts removed.Host, agency or authorityAgency finds the way in: plugin, password or hosting, and closes it.
- Hour 24Google and emailYouRequest a review in Search Console. Check SPF, DKIM and DMARC.Host, agency or authorityGoogle decides after a few days to a few weeks.
- Hour 72ReportYouData protection authority if personal data could have leaked. Tell customers if the risk is high.Host, agency or authorityNational CSIRT: required under NIS2 (24 and 72 hours), voluntary otherwise.
The 72 hours for the breach notice start when you know personal data could have left, not at the moment of the hack.
Hour 0: lock down, do not clean
The first hour is about access. From a device you trust, not the laptop that may have opened an infected attachment, change the passwords of your hosting account, every admin account on the site, FTP or SFTP, the database, and the mailbox you use for password resets. Then switch on two factor authentication wherever it is offered. Without that second lock, a new password is stolen again by the next phishing email.
Then copy the site as it is: files and database. You never restore that infected copy, but it shows later what changed and since when.
Take it offline or not? Put the site in maintenance mode, or ask your host to suspend it, if it redirects visitors, spreads malware or leaks personal data. An online store that could pass on payment details always goes offline. A brochure site with a few spam pages can stay up while you restore.
Hours 1 to 4: restore a clean copy
A backup from before the hack is the fastest way back. Find the last copy from before the first strange change; the infected copy and your host's logs show when that was. Restore it, then update everything straight away: core, every plugin, every theme, the PHP version of the server. Restore an old backup without updating and you restore the hole with it.
Without a usable backup, cleaning is what is left: comparing every file with a clean version, searching the database for injected scripts and unknown admins, and finding the backdoor. That takes someone who has done it before, and it takes days rather than hours. A website maintenance plan makes sure there is a copy every day.
Find the way in: plugin, password or hosting
A site you restore without knowing the cause gets hacked again. On WordPress it is usually a plugin: of the 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 91% were in plugins and 9% in themes, and 46% had no fix available when the flaw went public.
| Cause | How you find it | What you do |
|---|---|---|
| Outdated or abandoned plugin | It appears in a list of known flaws, or had no update for a year | Delete it, do not just deactivate it, and find a maintained alternative |
| Stolen or weak password | Logins from an unknown country or time in the log | New passwords everywhere, two factor authentication, unused accounts removed |
| Shared hosting | Other sites on the same server infected, or your host says so | A host that isolates your site, or a different setup |
| Nulled theme or plugin | A paid plugin downloaded free from another site | Remove it: these often ship with the backdoor built in |
Hours 4 to 24: tell Google it is fixed
If Google flagged your site, Search Console lists it under Security Issues with sample URLs. Fix the problem across the whole site, not only the samples, then request a review with a short note: what it was, what you did, what the result is. Google emails you on receipt and on its decision; a review takes a few days to a few weeks. Do not send a second request while the first is open.
In the same window, check whether your server sent spam. A domain on a blocklist does not come off by itself: after the clean-up you ask the list to delist it. Then set SPF, DKIM and DMARC so nobody can send mail that looks like yours.
Hours 24 to 72: the breach notice and the national CSIRT
| Who | When it is required | Deadline |
|---|---|---|
| Your data protection authority (ICO in the UK, GBA in Belgium, AP in the Netherlands, the state authority in Germany) | When personal data could have leaked: customer accounts, form entries, a mailing list | Within 72 hours of becoming aware |
| The people whose data leaked | When the breach is a high risk to them, such as passwords or payment details | Without undue delay |
| The national CSIRT or cyber authority (CCB in Belgium, NCSC in the UK and the Netherlands, BSI in Germany) | Required under NIS2 for a significant incident; voluntary for everyone else | Early warning in 24 hours, notification in 72, final report in a month |
| The police | Not required, but needed for insurance and in case of extortion | As soon as you can |
The 72 hours start when you are reasonably sure personal data could have left, not at the moment of the hack. If you do not know everything yet, report what you know and add to it later. Whether your company falls under NIS2 is explained in NIS2. If an agency or host processes personal data for you, your data processing agreement says who reports what.
What a hack costs you, in time
With a clean backup and someone who has done it before, your site is usually back within a working day. Without a backup it becomes a clean-up of days, and the hardest part is not the site but everything around it: days to weeks of a Google warning, mail that does not arrive, and customers you have to inform. That is why preventing the next one pays more than cleaning up faster.
Why a static site is harder to break
The sites we build, such as the one for Business Centrum, are static exports on Amazon S3 behind CloudFront. There is no admin panel, no database and no plugin on the server to crack: the server only hands out finished pages. That choice has a price, because changing a text goes through us or through code rather than a dashboard, and custom website or WordPress weighs it fairly. A static site still has accounts, a domain and forms to protect; its SSL certificate renews itself, the password of your registrar does not.
Ready for next time
- A daily backup stored outside your hosting, and a test restore once a year.
- Two factor authentication on hosting, admin, registrar and email.
- One account per admin, no shared password.
- Automatic updates for core and plugins, and unused plugins deleted.
- Search Console set up, so Google warns you before a customer does.
- A list of who to call: your host, your agency, your insurer.
Short answers on a hacked site
Is there a website hacked checker I can trust?
Search Google for site:yourdomain.com and look for pages you do not recognise, and open your site on a phone from a search result. Search Console's Security Issues report is the check that counts for Google.
Do I have to report a hacked website?
To your data protection authority within 72 hours if personal data could have leaked. To your national CSIRT if you fall under NIS2; anyone else may report voluntarily.
How long does the Google warning stay?
Until Google approves your review, which takes a few days to a few weeks. Only request it once the whole site is clean.
Will a security plugin protect me?
A firewall and a scanner catch a lot, but they are plugins that need updates too. Fewer plugins and prompt updates protect more than one more plugin.