Website Hacked? Emergency Recovery Guide for Business

A practical incident-response guide for business websites that are offline, compromised, redirected, defaced, or behaving unexpectedly.

Preserve evidence before making random changes

If compromise is suspected, record the time, symptoms, recent changes, hosting alerts, affected URLs, screenshots, and available logs. Avoid deleting files or reinstalling everything before you understand what happened, because that can destroy evidence that helps identify the entry point.

Contain the immediate problem

Reset compromised credentials, restrict administrative access, isolate affected systems when necessary, and work with the hosting provider to stop active malicious behavior. If customer data may be involved, preserve logs and involve the appropriate security, legal, insurance, or compliance contacts.

Restore from a known-good state

A backup is useful only if it predates the compromise and can be trusted. Restore the application, database, and configuration from a known-good point, then patch the vulnerability that allowed the incident before returning the site to normal service.

Check the full attack surface

Review CMS core files, plugins, themes, server accounts, SSH keys, API keys, DNS, CDN settings, email accounts, scheduled tasks, database users, and third-party integrations. Attackers often create persistence outside the first visible infected file.

Verify recovery and prevent recurrence

After restoration, test important pages, forms, checkout or lead flows, analytics, redirects, SSL, DNS, and monitoring. Add file-integrity monitoring, stronger authentication, least-privilege access, tested backups, update procedures, and security alerts so the next problem is detected sooner.

Frequently asked questions

What should I do first if my website is hacked?

Record the time, symptoms, recent changes, hosting alerts, affected URLs and logs before changing anything. Avoid deleting files or reinstalling everything, since that can destroy evidence of how the attacker got in.

Can I just restore a backup after a hack?

Only if the backup predates the compromise and can be trusted. Restore the application, database and configuration from a known-good point, then patch the vulnerability that allowed the incident.

How do I stop my site from being hacked again?

Check the full attack surface, including plugins, themes, server accounts, SSH keys, API keys, DNS and scheduled tasks. Then add file-integrity monitoring, stronger authentication, least-privilege access, tested backups and security alerts.

Website Down or Hacked? An Emergency Recovery Guide