Your Site Got Hacked: What to Do in the First 24 Hours

The moment you realise your site has been compromised, the first moves shape the days that follow. Panic-deleting everything makes things worse, and so does waiting in the hope it fixes itself. The plan below is meant to be followed in order, starting from the first hour.

Signs: how do you know your site has been compromised?

Sometimes it's obvious: a message you don't recognise on the homepage, a completely changed look. But many attacks are quiet, because the attacker wants to use your site unnoticed. Watch for these signs.

When you search for your site on Google, titles or descriptions show Japanese characters or terms about pharmaceuticals, gambling or betting. Visitors coming from mobile or Google are redirected to another site, while the site opens normally when you type the address directly. The browser or Google shows a security warning. Search Console sent a 'Security issues' notification. Your host warned you because bulk spam email was sent from your account. There's an admin user you don't recognise in the dashboard.

Even one of these means the site needs to be investigated.

The first hour

The goal of the first hour is to limit damage and preserve evidence. Order matters:

• Take a copy of the current state, compromised as it is. You'll need it to understand what the attacker did and how they got in. You can take a file and database backup from your hosting panel.
• Put the site into maintenance mode, or ask your host to take it offline temporarily. Continuing to send visitors to a malicious site harms them and your reputation on Google.
• Notify your host's support team. Ask what they see at the server level; they often have more access to logs than you do.
• Change passwords: site admin, hosting panel, FTP/SFTP, database and domain account. Do this from a device you're sure is clean.
• Check the admin user list and delete any accounts you don't recognise.
• If the site stores customer data (form submissions, accounts or order details), the incident may count as a personal data breach and notification obligations under KVKK may apply. Assess this with a lawyer without delay.

If you don't use two-factor authentication, turn it on while changing passwords.

Clean up or restore from backup

Now you have two paths: clean the site or restore from a clean backup.

If you know when the attack started and have a backup from before that you're sure is clean, restoring is often the fastest route. But be careful: if you restore and change nothing else, the hole the attacker used is still there, and the same thing can happen again soon. Right after restoring, update all software, themes and plugins and change the passwords again.

If there's no clean backup, or the attack is too old to know when it began, you need a cleanup. This usually involves: replacing core files with fresh ones from the official source if you use an off-the-shelf content management system, deleting themes and plugins and reinstalling them from official sources, searching upload folders for PHP files that shouldn't be there, and removing malicious links and users added to the database. This takes technical knowledge and care; missing a single file can be enough for the attacker to come back. If this is outside your expertise, we recommend getting professional help.

We explained why backups need testing in a separate article. Many businesses in this situation learn at this exact moment that the backup they thought they had doesn't exist or is incomplete.

Removing Google's security warning

If Google detected malicious content on your site, it may show a warning in search results and in Chrome. The warning doesn't disappear automatically when you clean up.

In Search Console, go to 'Security & Manual Actions' and open the 'Security issues' report. Google shows which issues it detected and sample affected pages. Check that those pages really are clean. Then request a review from the same report, describing briefly and clearly what you did: which hole was closed, which files were cleaned, which measures were taken.

The review can take a few days. If the cleanup is incomplete, the request is rejected and the process drags on, so don't rush to submit.

Spam pages showing in Google (fake pages created under your site) may stay in search results for a while after cleanup. If they now return a 404 or 410 error, Google will drop them from the index over time.

Making sure it doesn't happen again

Cleaned sites getting compromised again is common, because cleanups often happen without closing the entry point. After cleaning up: keep all software updated regularly, fully delete unused plugins and themes, use strong passwords and two-factor authentication on admin accounts, set up automatic backups stored off the site, and limit login attempts to the admin panel.

We collected security measures in detail in a separate article. If your site is compromised right now and you don't know where to start, you can write to Kodyva; we'll assess the situation together and talk through which path fits.