First: do not panic, and do not delete anything yet
The most damaging mistake after discovering a hack is deleting files or the whole site in a panic before you have a clean backup or a record of what happened — this destroys evidence you may need and can make recovery harder, not easier. Take a breath; a compromised site is a solvable problem in the vast majority of cases.
Immediate steps (first 30 minutes)
- Take your site offline or into maintenance mode if it is actively serving malicious content to visitors, to limit further damage and protect your visitors
- Change every password connected to the site immediately — hosting account, control panel, database, CMS admin, and FTP/SFTP — assume all were exposed
- Check for backups from before the compromise; do not overwrite them
- If you have malware scanning enabled (such as SiteLock), run an immediate scan to identify what was injected and where
Cleaning up the infection
If you have a clean backup from before the infection, the fastest and most reliable fix is usually restoring from that backup rather than manually hunting for every infected file — a compromise often leaves multiple backdoors, and manual cleanup risks missing one. If you do not have a clean backup, a malware scanning and removal service can identify and strip out injected code, though this process can take longer and occasionally requires manual verification afterward.
After restoring or cleaning, update everything — your CMS core, every plugin/theme, and any custom code — since outdated software with known vulnerabilities is the single most common way sites get compromised in the first place.
Checking for lingering access
- Review admin/user accounts on your CMS for any unfamiliar accounts created during the compromise, and remove them
- Check for unexpected scheduled tasks (cron jobs) that may have been added to re-infect the site after cleanup
- Review your .htaccess file (or equivalent) for injected redirect rules sending visitors to malicious sites
- Rotate any API keys or third-party service credentials that were stored in the codebase
If your domain got blacklisted
If Google or a browser is showing a "this site may be hacked" or "deceptive site" warning, you will need to request a review after cleanup is complete — through Google Search Console's security issues section, and through any other blacklist your domain was flagged on. This step matters: even after your site is clean, visitors will keep seeing the warning until the blacklist listing itself is cleared.
Preventing the next one
Two things meaningfully reduce the chance of a repeat: ongoing malware scanning that catches problems within a day rather than weeks later, and automated daily backups so that if something does get through, recovery is a restore rather than a rebuild. Keeping your CMS, plugins and themes updated on a regular schedule closes the single most common entry point attackers use.