Website Hacked? What to Do — Emergency Triage Guide
If your website is hacked: 1) take it offline immediately, 2) change all passwords, 3) check for suspicious files and database entries, 4) restore from a clean backup, 5) patch whatever caused the breach.
If your website is hacked: 1) take it offline immediately, 2) change all passwords, 3) check for suspicious files and database entries, 4) restore from a clean backup, 5) patch whatever caused the breach.
Signs your site has been hacked
Most hacks are not announced. You usually discover an infection through one of these signals: Google flags your site with a “This site may be hacked” warning in search results; visitors complain about strange redirects to pharmaceutical or gambling pages; your website loads but looks different (defacement); unfamiliar files appear in your web root; new admin users you never created show up in your CMS; or your hosting provider suspends your account due to abuse reports.
The average detection time for a compromised website is 196 days. By that point the damage is rarely limited to one page. Catching it early is everything.
| Hack type | What you will notice | Common cause |
|---|---|---|
| Malware injection | Strange scripts in page source, pop-up ads, browser warnings | Vulnerable plugin, nulled theme |
| Defacement | Homepage replaced with hacker’s message or image | Stolen admin credentials |
| Phishing pages | Hidden subdirectories with fake login forms | Compromised FTP account |
| SEO spam | Hidden links to gambling, pharma or porn sites in your content | Outdated CMS software |
| Backdoor shells | Unknown PHP files with obfuscated code, unexpected admin users | Unpatched vulnerability |
Emergency triage — 5-step runbook
If you confirm a compromise, follow this exact sequence. Skipping steps or working in the wrong order makes the clean harder.
- Take the site offline. Replace your index page with a static maintenance notice, or disable the site through your hosting control panel. This stops the infection from affecting more visitors and prevents search engines from indexing malicious content.
- Change every password. Start with your hosting control panel, then your CMS admin, FTP/SFTP accounts, database users, and email accounts linked to the domain. Use long unique passwords generated by a password manager.
- Identify the entry point. Check your server access logs for unusual POST requests to admin pages. Review recently modified files by date. Look for unexpected scheduled tasks or cron jobs. Common entry points are outdated plugins, nulled themes, and weak admin passwords.
- Take a full backup of the infected site. Do this before you change anything. You will need the infected files to investigate the root cause later, and you may need forensic evidence if law enforcement or your bank gets involved.
- Restore from a known clean backup. If you have a backup from before the infection date, restore it. If not, you will need to clean the current site manually or use a malware removal service.
How to clean a hacked website
Cleaning without a clean backup is painstaking work. The goal is to remove every malicious file, code injection, and backdoor rather than patching symptoms.
Start by downloading all website files to your local machine and scanning them with a reputable malware scanner. Look for obfuscated PHP code, base64-encoded strings in unexpected locations, files with recent modification timestamps that you didn’t create, and unfamiliar JavaScript files that load from external domains.
Check your database for injected content. Attackers often add hidden spam links to post content, widget areas, and options tables. Run SQL queries to find suspicious entries containing words like “viagra”, “casino”, or pharmaceutical terms in unexpected fields.
After cleaning, verify that every user account with administrative privileges is legitimate. Remove any you didn’t create. Reset all API keys, integration tokens, and third-party service credentials the site uses.
How to recover and regain trust
Once the site is clean, you need to earn back your visitors’ and search engines’ trust. Submit your site for review in Google Search Console if it was flagged. Request a security review through the “Security Issues” section. This process can take anywhere from a few hours to several days depending on the severity.
Publish a brief security notice on your site explaining what happened, what data (if any) was affected, and what you have done to fix it. Transparency builds confidence. If you process payments or handle personal data, check your legal obligations for notifying affected users and regulators.
Monitor your site closely for the first month after recovery. Many attacks leave dormant backdoors that activate after the clean appears complete. A web application firewall and file integrity monitoring tool will catch these reactivations quickly.
Prevention moving forward
The cost of prevention is much lower than the cost of cleaning up a hack. Implement these measures to reduce your risk substantially:
- Keep everything updated. Outdated CMS core, plugins, themes, and server software cause the overwhelming majority of compromises. Enable automatic updates where possible.
- Use strong authentication. Enforce complex passwords, enable two-factor authentication on all admin accounts, and limit login attempts to prevent brute force attacks.
- Apply the principle of least privilege. Give each user account only the permissions it needs. Do not use the admin account for day-to-day content editing.
- Regular backups. Automate daily backups with off-site storage. A clean backup is the single most valuable asset you can have during recovery.
- Web application firewall. A WAF blocks common attack patterns before they reach your CMS, including SQL injection and cross-site scripting attempts.
The hosting provider’s role in security
Your hosting provider is your first line of defence. A good host applies server-level security patches, monitors for malicious traffic patterns, isolates accounts from each other, and provides tools for you to secure your own site. A host that does none of these things leaves you exposed regardless of how carefully you maintain your CMS.
At BahrainServer, every managed plan includes automated daily backups with 30-day retention, a web application firewall, malware scanning, and automatic CMS and plugin updates. Our infrastructure is monitored 24/7 for suspicious activity, and our support team can assist with malware removal if an infection occurs. Plans start from BD 3.5 a month.
Frequently asked questions
Common signs include unexpected redirects to spam sites, warnings from Google Search Console, unfamiliar files or user accounts in your admin panel, defaced pages, a sudden drop in traffic, and unusual database entries such as admin users you didn’t create.
If you have a clean backup and know how to restore it, yes. Otherwise professional help is safer. An incomplete clean leaves backdoors that will be re-exploited within days. Most hosting providers including BahrainServer offer free or paid malware removal as part of managed plans.
A straightforward restore from a clean backup takes 1–2 hours. Deep cleaning an infected site without a backup can take 1–3 days depending on the severity and the number of injected files.
No host can prevent every attack, but a good host reduces the risk significantly. BahrainServer includes automated daily backups, a web application firewall, malware scanning, and automatic CMS updates on managed plans so even if something happens, recovery is fast.
Outdated CMS software and plugins cause the majority of compromises. The second most common is weak or reused passwords. Keeping everything updated and using strong unique passwords prevents around 80% of attacks.