Website hacked? What to do in the first hour

WindowsMacUpdated

Google's guide to recovering a hacked site starts with your hosting company. Then take the site offline if you or your host can, change every password that touches it, check for admin accounts you didn't create, update the software and restore from a backup made before the hack. Personal data and crime reporting come last.

Quick answer

Contact your host and ask them to help take the site offline. Change your hosting, admin, database and FTP passwords. Delete admin users you don't recognise. Update PHP and WordPress or your CMS, then restore a clean backup. Check the Security issues report in Google Search Console, and if customers' personal data may be involved, follow the ICO's 72-hour guidance.

What should I do first if my website has been hacked?

Contact your hosting company. Google's recovery guide says your host can check that their other customers weren't affected, and may be able to help recover the site. WordPress adds that on shared hosting a hack may have affected more than your site.

  1. Write down what you're seeing and when you noticed it. WordPress calls this the first actionable step.
  2. Tell your host the site has been compromised, and ask what backups they hold.
  3. Ask them to take the site offline, or help you do it. Google says this stops harmful files reaching visitors, and that a robots.txt block isn't enough because it only stops search engines.
  4. Decide whether you can fix it yourself. Google says that needs the ability to read code and use command-line server tools. If not, ask your host or a qualified professional.

Which passwords should I change, and what about admin users?

All of them that reach the site. Google's guide names logins for FTP, database access, system administrators and the content management system, and says to check whether the attacker created a user account. WordPress adds cPanel or any other hosting panel, and says this goes for every user with access.

  1. Change your hosting account and control panel passwords.
  2. Change the FTP or SFTP passwords.
  3. Change the database password. WordPress notes the new one has to go into wp-config.php too.
  4. Open the list of users on your site (in WordPress, Users in the dashboard). Note any accounts you don't recognise, then delete them.
  5. Reset the passwords of every remaining admin account.
  6. Change them all again once the site is clean. WordPress says passwords changed when you found the hack should be changed a second time after the clean-up.

WordPress also suggests scanning your own computer with antivirus, because some attacks start by stealing FTP or admin logins from the owner's machine.

Should I restore from a backup?

Yes, if you have one from before the hack. Google's Search Console help gives restoring the last known good backup as one way to clean a hacked site. WordPress suggests first taking one more copy of the infected site, as a reference if something goes wrong.

  1. Take that snapshot of the current site first.
  2. Pick a backup made before the date you first noticed the problem.
  3. Restore it, or ask your host to.
  4. Update everything straight away, before putting the site back online. A restored backup still has the old software that may have let the attacker in.

Do I need to update PHP and WordPress?

Yes. PHP announced two critical flaws on 21 October 2026, CVE-2026-109618 and CVE-2026-109619, which could allow remote code execution without a login. PHP's advisory says the fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and that updating is the only safe choice. As of 23 October 2026, QNAP's advisory of 22 October notes that exploitation attempts against PHP have been publicly reported.

  1. Ask your host which PHP version your site runs, and whether it is now on one of those fixed versions.
  2. If you're on PHP 8.1 or older, PHP no longer releases official updates for it. Ask your host about moving to a supported version.
  3. Update WordPress to the latest version. WordPress says older versions are more prone to hacks than newer ones.
  4. Update your themes and plugins too. WordPress singles out the theme and plugin files as the place to be most careful.

The NCSC's advice, for a PHP system that can't be updated straight away, is to check it for signs of compromise and backdoors before you upgrade. Updating closes the hole, but it doesn't remove anything an attacker already left behind.

How do I get Google to remove the hacked site warning?

Google's Security issues report in Search Console shows whether Google has found hacked content, malware or phishing on your site, with sample URLs. Affected pages can show a warning in search results or the browser.

  1. Open the Security issues report in Search Console.
  2. Use the sample URLs to find the affected pages, then fix the problem across the whole site. Google says fixing only some pages won't restore it.
  3. Once the site is clean, the hole is fixed and the site is back online, select Request Review.
  4. Describe what you found and what you did. Google says most reviews take several days or weeks, and not to resubmit until you get a final decision.

What if customer data may have been involved?

If the site holds customers' personal data, such as names, emails or orders, and it may have been accessed, the ICO's guide for small businesses and sole traders applies. You must report a breach to the ICO without undue delay and within 72 hours of discovering it, if it meets the threshold for reporting. If there's a high risk to the people affected, the law says you have to tell them without undue delay.

  1. Start a log of what happened, who is involved and what you're doing. The ICO says to keep one even if you don't report.
  2. Use the ICO's self-assessment tool to decide whether the breach is reportable.
  3. If you're unsure, call the ICO's personal data breach advice line on 0303 123 1113.

The ICO says this guidance is under review after the Data (Use and Access) Act, so check the current page.

More questions

Should I report a hacked website to the police?

The NCSC says that if you've lost money, tell your bank and report it to Report Fraud. GOV.UK says Report Fraud replaced Action Fraud on 4 December 2025 as the national service for reporting cyber crime and fraud, online at reportfraud.police.uk or on 0300 123 2040. GOV.UK's report-cyber page also signposts where to report.

Is my website affected by PHP2Shell?

If it runs on PHP and serves web pages, it's in scope until it's on a fixed version. How to check your website's PHP version shows where to look.

Can I just restore a backup and carry on?

A backup removes what the attacker added, but not the weakness they used. WordPress says to update the software once the site is clean and to change the passwords again. Google says to request a review only once the vulnerability is fixed.

Is my website hacked?

WordPress lists clear signs: the site is flagged by Google or Bing, your host has disabled it, it's flagged for malware, visitors' antivirus warns about it, or there are changes nobody authorised, such as new users.

Where can I get free help with a hacked WordPress site?

WordPress points to its own support forums, which have hacked and malware sections. Google's guide mentions the Google Search Central discussion forum, which has a subforum for malware and hacked sites.

Sources