Guide · Security
Website hacked: what to do, step by step
Signs of a hacked website vary: strange redirects to other sites, spam pages in Google results, a browser warning, unknown admin users, a defaced home page, or a message from your hosting provider. The first hours matter. Acting calmly and in the right order limits the damage and prevents the attacker from returning a week later. This guide is a step-by-step plan.
[ 01 ]
In short
In short
- 01
Contain first: take the site offline or into maintenance mode if it harms visitors, and block the attacker's access.
- 02
Preserve evidence — logs and copies — before changing too much.
- 03
Find how the attacker got in; otherwise, they will come back.
- 04
Clean the site or restore from a backup made before the compromise, then fix the vulnerability.
- 05
Change all credentials, check search engines and notify affected parties where required.
[ 02 ]
Guide
Step 1: contain
- If the site redirects visitors to malicious pages or distributes malware, put it into maintenance mode or take it offline.
- Change passwords for hosting, admin panels, databases and FTP/SSH immediately — from a clean device.
- Revoke unknown admin users and API keys.
- If payment or personal data may be affected, inform your payment provider and prepare for notification obligations.
Step 2: preserve evidence
Before cleaning, save copies of server logs, the current files and the database. They help find the entry point and may be needed for legal reasons or insurance.
Step 3: find the entry point
Common entry points:
- outdated CMS, plugins or themes with known vulnerabilities;
- stolen or weak passwords;
- a vulnerable file upload form;
- compromised developer or contractor accounts;
- neglected test copies or old installations on the same server.
Review logs around the time of the first signs, file modification times and new files. Without identifying the cause, restoration is temporary.
Step 4: clean or restore
- Restore from a backup made before the compromise, if one exists and the date of compromise is known. Then apply the fix for the entry point before going live. See backups and recovery.
- Clean if no clean backup exists: remove malicious files and database entries, reinstall the platform and extensions from official sources, and verify integrity.
In both cases, update all software to current versions.
Step 5: change all credentials
All passwords, database credentials, API keys and secrets that the attacker could have seen. Enable two-factor authentication. Review who has access. See access management for teams.
Step 6: check search engines and reputation
- Google Search Console: security issues report, manual actions, spam pages indexed. Request a review after cleaning.
- Remove spam URLs created by the attacker, returning 404 or 410.
- Check if your domain is on blocklists and request removal after cleaning.
- Check that your email domain was not used for spam; see email domain security.
Step 7: notify
If personal data may have been accessed, consult your lawyer about obligations under Azerbaijan's personal data law and other applicable laws, and about informing affected people. Inform partners whose systems connect to yours.
Step 8: prevent recurrence
- Regular updates and a staging process for testing them.
- Monitoring of file changes, admin logins and availability. See 24/7 monitoring.
- Tested backups with off-site and immutable copies. See backup strategy.
- A security audit of the whole setup. See security audit.
- A written incident playbook for next time.
[ 03 ]
FAQ
Frequently asked questions
Can we just restore the backup and move on?
Only after finding and fixing the entry point. Otherwise, the attacker returns through the same hole.
How long does recovery take?
From hours, for a clean restore of a simple site, to days for complex sites without clean backups.
Should we report the attack to the police?
For significant incidents — data theft, extortion, fraud — yes. Consult your lawyer on reporting obligations.