The calls usually start the same way. A customer says your website sent them to a dodgy pharmacy. Or Chrome shows a red warning screen. Or your host has emailed to say your account is suspended for sending spam. Your stomach drops, and the temptation is to start clicking things.
Don’t. Most of the damage we see after a hack comes from panicked fixes in the first hour: deleting files that would have shown how it happened, restoring an infected backup, or changing one password while leaving four others open. Work through this in order instead.
Minutes 0 to 10: confirm what’s going on
First, check it isn’t something else. Expired domains, expired SSL certificates and hosting outages can all look alarming without being a hack.
Signs it really is a hack:
- Visitors (often only on mobile, or only from Google) get redirected to spam, gambling or scam sites
- Google search results for your business show Japanese characters, pharmacy terms or pages you didn’t create
- Browsers show a “Deceptive site ahead” or similar warning
- Your host says your account is sending spam or has malware
- There are admin users you don’t recognise
- Pages or posts have been changed, or new ones appear
Write down what you saw, when, and on what device. Take screenshots. Whoever cleans this up will want to know.
If you have Google Search Console set up, check the Security issues report. Google’s Security issues report help page explains what each type of problem means. It’s also where you’ll later ask Google to remove any warning.
Minutes 10 to 20: get the right people involved
Call your web developer or the person who manages your site. If you don’t have one, call your host. Good hosts deal with this regularly and can often tell you a lot from their server logs.
While you’re on the phone, ask them to:
- Take a full copy of the site as it is now (files and database), before anything is changed. It’s evidence, and it helps find how they got in.
- Put the site into maintenance mode or temporarily block public access if it’s actively harming visitors
- Check whether other sites on the same hosting account are affected
If you’ve got neither a developer nor a host who’ll help, the WordPress project’s own guide, Help, I think I’ve been hacked, is a sensible starting point. Be realistic, though. Cleaning a hacked site properly is skilled work, and a half-cleaned site is usually re-infected within days.
Minutes 20 to 35: change the passwords, all of them
Attackers often take passwords along with everything else, so assume every login connected to the site is compromised. Change them from a device you trust, not the computer you suspect may be infected.
In this order:
- Hosting control panel (cPanel or your host’s dashboard). This is the master key.
- Every WordPress administrator account. Then remove any admin users you don’t recognise.
- FTP and SFTP accounts on the hosting.
- The database password, which your developer will need to update in the site’s configuration too.
- Domain registrar login, especially if it shares a password with anything above.
- Email accounts on the same domain, if they’re hosted with the website.
Turn on two-factor login for each one that supports it while you’re there. And if the same password was used anywhere else (your banking, Xero, Google), change it there as well.
Minutes 35 to 50: restore from a clean backup, carefully
If you have offsite backups going back several weeks, this is where they pay for themselves. The hard part is choosing which one.
Hacks often sit unnoticed for days or weeks before the obvious symptoms show up. Last night’s backup may already be infected. Your developer should restore a backup from before the earliest sign of trouble, then check it, rather than restoring the most recent one and hoping.
Restoring old files brings back the old vulnerability too. A restore alone isn’t a fix. Straight after restoring, everything needs updating, and any abandoned or suspicious plugins need removing. Content changes made since that backup (new blog posts, orders, form entries) may need to be added back by hand.
No usable backup? Then the site needs to be cleaned file by file, or rebuilt. That takes longer than an hour, and it’s the strongest argument we know for proper offsite backups.
Minutes 50 to 60: find the hole and decide who to tell
How did they get in?
Whoever restores the site should also look for the cause. The usual suspects on small business sites are an outdated plugin or theme with a known vulnerability, a weak or reused password, a nulled (pirated) plugin, or another infected site on the same hosting account. If the cause isn’t found and fixed, expect a repeat.
Who needs to know?
Think about what data your site holds. If it’s a brochure site with a contact form that emails you, the exposure is limited. If it stores form entries, customer accounts, orders or patient information, take this more seriously.
Under the Notifiable Data Breaches scheme, many organisations must assess a suspected breach and notify affected people and the regulator if serious harm is likely. It applies to businesses with annual turnover above $3 million, and also to some smaller ones, including private sector health service providers. The OAIC’s quick reference guide for responding to data breaches sets out who’s covered and the steps, including the 30-day window to assess a suspected breach. This is general information, not legal advice, so if your site held personal information, get proper advice on your obligations.
You can also report cybercrime to police through ReportCyber, and the Australian Cyber Security Centre runs a 24/7 hotline on 1300 CYBER1 (1300 292 371). Details are on cyber.gov.au.
Even when there’s no legal requirement, tell customers if they might have been affected. A short, plain email (“our website was compromised on this date; this is what was involved, what we’ve done, and what you should do”) does far less damage to trust than them finding out some other way.
After the first hour
Once the site is clean and running, a few things can wait until tomorrow, but not much longer:
- Request a review in Search Console if Google flagged the site, so the warning comes off
- Check Google results for spam pages and ask for any that remain to be removed
- Ask your host whether the site was blacklisted for spam email, and check that your own domain’s email is still being delivered (a blacklisting can drag down your business email as well as the site)
- Go through the steps in WordPress security for business owners so this doesn’t happen again
- Write down what happened and what you did. You’ll want it if anyone asks
Save this now, before you need it
Put three things somewhere you can find them on a bad day: your developer’s or host’s phone number, where your offsite backups live, and a list of every login connected to your website. If you can’t fill in all three today, that’s your job for this week.
We clean up and fix WordPress sites for businesses around the Northern Rivers. If your site has been hacked, contact us and say so in the first line, and if you want hosting that comes with someone who’ll answer the phone, see our hosting and care plans.