What to do when your business website is hacked.

The first hour

The usual mistake after a hack is rushing the wrong step: restoring an old copy over the evidence, changing one password and leaving the rest, or saying nothing to customers who were sent to a scam page. Work in this order:

• Write down what you saw, when and on which device, with screenshots of the page, the search result or the warning.
• Call your host and whoever looks after the site, and ask them to take the site offline if it is sending visitors somewhere harmful.
• Change the passwords that open everything else, from a computer you trust.
• Check what Google sees in Search Console.
• Restore a clean copy and close the hole the attacker came through.
• Work out whether customer data was reached, and who needs to be told.
• Then fix what let it happen.

Plan to spend the first day on this and little else. A site that serves malware for a week does more damage than one that is offline for an afternoon.

Confirm that it really is a hack

The signs owners usually see first:

• Chrome or Safari shows a red warning page before your site loads.
• Google results for your business carry a warning that the site may be hacked, or list pages you never wrote, often in another language or selling something.
• Visitors from a phone or from Google land on a scam page, while the site looks normal when you type the address yourself.
• Admin users you do not recognise, or files and pages that appeared from nowhere.
• Your host suspends the account, or emails about malware or spam sent from your server.

Some hacks hide from the owner on purpose and redirect only visitors who arrive from a search or on a phone. Google notes that its warnings depend on how someone reaches the site, so you may not see them yourself. Test from a Google search result on a phone, on mobile data, before you decide all is well.

A flood of junk messages through your contact form is spam, not a hack: how to stop contact form spam deals with that. And a Not secure label in the address bar is about the site's certificate, which why your website says not secure covers.

Who to call, in order

• Your host. Google's advice is to tell them straight away, because their systems may be affected too, and they may be able to take the site offline or restore it. Ask whether cleaning up a hacked site is part of your plan.
• Whoever built or maintains the site. They know what it runs and where the backups are.
• A company that cleans hacked sites, if neither of the first two can. Ask what they will do, how they will find the way in, and what happens if the site is hacked again.
• Your website platform's support, if the site is on Wix, Squarespace or Shopify. The platform runs the servers, so the first thing to check is your account: who can sign in, and whether two-step verification is on.
• Your payment provider, if the site takes payments and the checkout may have been touched.

If you have none of these people, that is the first gap to fix when this is over.

Take the site offline if it is harming visitors

If the site sends visitors to scams or serves malware, Google's guidance is to take it offline until it is clean, so it stops reaching people. The block has to happen outside the hacked server, for example a holding page set up by the host, or a DNS change that points to a simple page elsewhere, because the hacked server cannot be trusted. Blocking search engines with robots.txt is not enough: visitors can still reach the pages.

Put up a plain page with your phone number and one line, such as "Our website is down for maintenance. Call us on the number above or email us." For an online store, stop taking payments until the checkout has been checked.

Change the passwords that matter, in this order

Change them from a computer you trust. If a password was stolen by malware on the office laptop, a new one typed on the same laptop goes the same way.

• Your main email accounts, because every other reset link goes there.
• The domain registrar, because whoever controls it can move your website and email anywhere.
• The hosting account and its control panel.
• The website's admin accounts. First remove any user you do not recognise, then change every remaining password.
• FTP or SFTP, the database and any other system login the host gives you.
• Everything connected to the site: the payment provider, Google, Meta, analytics and the accounts for any paid plugins.

Turn on two-step verification wherever it is offered, starting with the same list. Google's cleanup guidance says to change the site's passwords more than once, with a final change after the clean reinstall, so expect to change the website ones twice.

Check what Google sees

Open Search Console and go to the Security Issues report. It lists the problems Google found in three groups: hacked content, such as pages or links someone injected; malware and unwanted software; and social engineering, such as fake login pages. Each entry shows example addresses, which tell your developer where to look.

If you do not have Search Console yet, set it up now with the business as owner. Google's Safe Browsing site status tool also shows whether Google currently flags the site as dangerous, without any login.

A site: search, such as site:yourdomain.com, shows the pages Google has found. Pages you never made, often with strings of random words in the address, are part of the hack and need removing too.

Restore a clean backup, then close the hole

A backup is the fastest way back, if you pick the right one. Google's guidance for cleaning a hacked site comes down to this:

• Choose a backup made before the hack started. Search Console, the host's logs and the date the symptoms began help pin that down.
• Before you change anything, keep a copy of the hacked site, away from the live one, so your developer or a security company can work out how the attacker got in.
• Restore, then fix the weakness. Restoring brings back the old site, and the old site had the hole in it.
• Prefer a clean install of the software to an upgrade, so no infected file survives.
• Update everything: the platform, the theme and every plugin. Remove plugins and themes the site no longer uses.
• If there is no clean backup, copy the infected site and clean the copy.

For a WordPress site, this is a job for a developer or a security company unless you have done it before. On a site builder there is less to restore: secure the account, check every page and connected app, and ask support what else they can see.

Clear the warnings

Once every listed problem is fixed on every affected page, open the Security Issues report and select Request Review. Say what the problem was, what you did to fix it and what the result was. Google says a review can take from a few days to a few weeks, and that asking again before you hear back can slow it down.

If you run Google Ads, ads that point at a hacked site can be disapproved under Google's compromised sites policy. Fix the site first, then resubmit or appeal the ads. Check any landing pages for ads as well as the main site, because they sit outside the main menu and are easy to miss.

Work out whether customer data was reached

List what the site held, and ask your developer or the security company, in writing, whether the attacker could have reached it:

• Form entries stored in the site, such as enquiries with names, phone numbers and messages.
• Customer accounts and passwords, if the site has logins.
• Orders and addresses, for a store.
• Payment details. If your checkout uses the payment provider's own form, card numbers never touch your server, but a hacked page can still copy what customers type before they send it.
• Health, legal or financial details sent through forms. Health details, such as those a dental practice collects, have extra rules: HIPAA in the US and the GDPR in Europe.

In Europe, the GDPR says a business must report a personal data breach to its data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put people at risk. Every breach has to be recorded, even one you do not report, and people must be told directly when the risk to them is high. Your host or developer, as your processor, must tell you without undue delay. In the US, every state has a breach notification law, and what it requires depends on the state and the data. Ask a data protection adviser or a lawyer the same day, because the clock starts when you find out. More in the GDPR checklist for small business websites.

What to tell customers

If customers were affected, by a redirect to a scam, a fake page or exposed details, tell them plainly and soon, once you have advice on what you must say. The FTC's guide for businesses suggests one point of contact and a plain account of what happened and what you are doing about it. A message that works:

"On Tuesday our website was hacked and, for some visitors, redirected to a page that was not ours. We have taken the site offline, cleaned it and changed our passwords. The details you sent through our contact form [may have been seen / were not affected]. We will never ask you for card details by email. If you get a message that seems to come from us and asks for payment, call us on the number you know. Questions go to [name] at [email address]."

Give your team the same few lines for the phone. Do not guess at causes you have not confirmed, and do not blame the customer's computer.

What decides the cost of the cleanup

Cleanups are priced by the work, and a few things decide how much there is:

• Whether a clean, recent backup exists. With one, much of the work is the restore and the fix.
• How many sites share the hosting account. An attacker who got into one can often reach the others, and every one needs checking.
• How long the hack ran before anyone noticed, and how many files and pages it added.
• Whether customer data was reached, which can bring in a security specialist and an adviser.
• Whether the site can be updated at all. Themes and plugins that are no longer maintained sometimes cannot be, and then the honest answer is a rebuild.

Ask for the cleanup, the fix of the way in and a check a few weeks later as separate lines on the quote, so you can see what you are paying for.

Stop it happening again

Google lists outdated software and leaked or guessed passwords among the usual ways in, so the list that prevents a repeat is short:

• Keep the platform, theme and plugins updated, and delete what you do not use.
• Give every person their own login with two-step verification, and remove people who no longer need access.
• Keep backups off the server, and test a restore now and then, as what website maintenance covers explains.
• Have Search Console send its alerts to an address someone reads.
• Agree before the next time who you will call, and whether cleanup is included in your hosting or support plan.

If the site is old, unsupported or hacked more than once, cleaning it again may cost more than rebuilding it, and a website redesign that keeps the pages and addresses that bring visitors can be the cheaper road. Our monthly plans include hosting, updates and backups, as the prices page lists.