Has Your Website Been Hacked? Warning Signs and the First 24 Hours

Summary

If you suspect you have a hacked website, preserve evidence, restrict access, notify the responsible technical team, take a backup or snapshot, identify the affected systems, rotate relevant credentials and restore only from a known-clean state. Do not randomly delete files or install multiple security plugins during the incident.

Common Warning Signs

Unexpected redirects, unfamiliar administrator accounts, search results showing spam pages, browser warnings, modified files, sudden traffic changes, outbound email abuse and unexplained resource usage can indicate compromise.

For example, a visitor may be redirected to an unrelated website instead of the intended page, or an unfamiliar administrator account may appear in the CMS. Search engines may also display unexpected spam content associated with the website.

A blank page or plugin error is not automatically a hack. Technical problems can also result from an update, configuration change or broken plugin, so diagnosis matters before taking further action.

Contain Before You “Clean”

Place the site in a controlled maintenance state if exposure is ongoing. Restrict administrator and hosting access, preserve logs and take a server snapshot where possible.

Hasty deletion can remove evidence, while restoring an old backup without fixing the entry point can reintroduce the same problem. The affected component or account should be investigated before the website is considered fully recovered.

Map the Affected Access

List CMS users, hosting, domain registrar, database, deployment tools, email accounts and third-party integrations. This helps identify which accounts and services may need to be reviewed.

Rotate credentials that may have been exposed, beginning with privileged accounts. End active sessions and remove unknown users where appropriate.

For example, if an unfamiliar administrator account is found, do not only remove the account and move on. Review how it may have gained access and whether other connected accounts or services could also be affected. Use a clean device for critical resets if endpoint compromise is suspected.

Recover from a Known-Clean Position

Identify the vulnerable component or stolen credential, patch it, scan the environment and compare files against trusted versions where possible.

If a backup is available, confirm that it represents a known-clean state before using it for recovery. Restoring a backup without addressing the original entry point can allow the same issue to return.

After recovery, test forms, payments, logins and analytics to make sure important website functions still work. Monitor closely after reopening because persistence mechanisms may not be immediately obvious.

Communicate According to Impact

Record the timeline, affected data, decisions and actions. Keeping a clear record helps the business understand what happened and provides useful information for technical teams or other parties involved in the response.

If personal data or customer transactions may be involved, obtain appropriate legal or privacy advice promptly. The appropriate response will depend on what was affected and the circumstances of the incident.

Avoid telling customers that everything is safe until the scope and recovery have been verified. Keep communication factual and update affected parties when there is confirmed information to share.

Prepare an Incident Contact Sheet

Keep a simple contact sheet outside the website containing the hosting provider, domain registrar, technical lead, privacy or legal adviser and authorised decision-maker.

Include the account references required to obtain support without storing passwords in the document. This ensures the right people can be contacted even if the website itself is unavailable.

During an incident, one person should coordinate actions and timestamps so several vendors do not overwrite evidence or reverse one another’s changes. A clear record also makes it easier to review what happened afterwards.

The Practical Takeaway

Treat website security as an operating decision, not a one-off website task. Document the owner, desired outcome and next review date.

Start with the highest-impact improvement, verify that it works for real users and keep evidence of the change. A focused, repeatable process will create more value than adopting tools or tactics without clear responsibility.

Review the result with both the person maintaining the website and the person accountable for customers or revenue. Their perspectives may expose different failures. Record what changed, what remains an accepted limitation and which trigger should cause the next review.

FAQs

Should I take the website offline?

If the site is harming visitors, leaking data or spreading malware, controlled isolation may be necessary. Preserve logs and evidence first where feasible.

Can I simply restore yesterday’s backup?

Only if it is known to be clean and the original entry point has been fixed.

Should I pay someone claiming they found malware?

Verify the claim independently. Do not provide access or payment based only on an unsolicited message.

Should I change all my website passwords after a hack?
Yes. Rotate credentials that may have been exposed, starting with administrator and hosting accounts.

When should I get professional help?

Get professional help if you cannot identify the source, the issue continues after cleanup or important business or customer data may be affected.