What should I do first if my site has been hacked?
Change every password, don't delete anything yet, and get help. The evidence of how they got in is what stops it happening again.
Hacked website repair.
Spam redirects, a Google warning, admin users you don't recognize. We find how they got in, clean it out, close the door and keep watching.
The signs.
Sometimes you don't see anything, which is the problem: attackers want to stay. These are the ones owners usually notice first.
Visitors sent elsewhere
Your site redirects some visitors, often only on phones or only from Google, to spam or scam pages.
A Google warning
"This site may be hacked" in search results, or a red warning page in the browser.
Admins you don't know
Administrator accounts nobody on your team created.
Plugins you never installed
Often with a harmless-sounding name, and the way the attacker gets back in.
Cleaning the visible mess isn't the fix.
Most break-ins leave a way back in: a plugin with a harmless-sounding name, an extra administrator, a file hidden among thousands of normal ones. Remove the spam and leave those, and the site is reinfected within days. So the work is finding everything they left, not just what you can see.
Full repair
- Planted plugins found and removed
- Extra admin accounts removed
- Altered files replaced with clean copies
- Passwords changed, everything updated
- Alerts read and sorted afterward
Cleanup only
- The spam is deleted; the plugin that put it there stays
- Admins nobody recognizes are left in place
- Hidden files stay among thousands of normal ones
- Same passwords, same out-of-date plugins
- Nobody watching, so it happens again
How it works.
Four steps. The first one is yours, and it's the one most people get wrong.
- 1
Don't delete anything yet
Change your passwords, but leave the site as it is. How they got in is the evidence that stops it happening again.
- 2
Find every way back in
Planted plugins, extra admin accounts and hidden files, not just the visible damage.
- 3
Clean and close the door
Remove what was planted, replace altered files with clean copies, update everything and remove accounts nobody uses.
- 4
Watch it
Every security alert read and sorted, with sign-ins from abroad flagged at once, and daily backups in three places.
Check us yourself.
Every mark here opens the record behind it.
Questions we hear.
Can you fix a site you didn't build?
Yes. We look at it first and tell you what we found before any work starts.
How much does it cost to fix a hacked website?
It depends on how far in they got and how long they've been there, so we quote after a look at the site. If the site is old or badly compromised, a rebuild can cost less than fixing it, and we'll tell you which.
Will it happen again?
The usual ways in are reused passwords, old plugins and forgotten admin accounts. Monthly maintenance closes all three, which is why we recommend a plan once the site is clean.
How did they get in?
Usually not through WordPress itself. A password leaked from another website gets tried on yours, or a plugin with a known hole sits unpatched.
What if I can't log in at all?
Start with the domain and the hosting account. With those, the site can be cleaned or rebuilt.
Keep reading.
Think your site's been hacked?
Tell us the address. We'll check it from the outside and tell you honestly what we see.
