01 / Guides
Has my website been hacked? The signs
Not every hack is obvious. Many attackers want to stay hidden and quietly use your server for spam or redirects. Typical signs:
- Visitors arriving from Google or on mobile are redirected to other sites, while everything looks normal on your laptop
- A Google search for site:yourdomain.com shows pages with Japanese characters, pharmacy or casino terms
- Chrome or Firefox show a red warning such as Deceptive site ahead or This site may be hacked
- WordPress has administrators nobody created, or you can no longer log in
- Your host suspends the site or reports unusual email sending or server load
- Google Search Console reports a problem under Security & Manual Actions
02 / Guides
How to check if a website is hacked
Three free checks give you a clear picture in minutes. In Google Search Console, the Security issues report shows whether Google found malware, phishing or hacked content, often with example URLs. The Google Transparency Report (Safe Browsing site status) shows whether your domain is flagged as unsafe. An external scanner such as Sucuri SiteCheck finds visible malicious code and blocklist entries.
These tools only see what is visible from outside. They will not find a quiet backdoor on the server, so a clean result does not mean you are safe if you see other signs.
03 / Guides
The first hour: what to do now
- 01
Delete nothing, document first
Take screenshots of warnings, redirects and injected content, with date and time. Note when and how you noticed the hack. That moment starts the GDPR's 72-hour clock.
- 02
Take the site offline
If the site spreads malware, hosts phishing or skims payment data, take it offline now. Your host can do it, or you block access with .htaccess and show a short maintenance page.
- 03
Tell your hosting provider
Support has server logs and backups, and often sees how the attacker got in. Ask explicitly for backups from before the attack and make sure they are not overwritten.
- 04
Change passwords, from a clean device
Hosting account, SFTP or FTP, database, every WordPress administrator, email accounts and your domain registrar. Turn on two-factor login wherever you can.
- 05
Save the hacked state
Download a copy of all files and the database, kept apart from your clean backups. You need it later to find the way in.
- 06
Work out whether data is affected
Are there customer accounts, a shop, contact forms that store enquiries, or a newsletter list? Then check the notification duty below before the 72 hours run out.
04 / Guides
Hacked website repair: the clean-up
Restoring a backup on its own is not enough, because the hole the attacker used is still open afterwards. This is how we work on WordPress; other systems follow the same logic:
- 01
Find a clean backup
Use logs and file dates to work out when the attack started, and restore a backup from before it. Without a clean backup, the following steps are done by hand.
- 02
Reinstall core, plugins and theme
Replace wp-admin and wp-includes with fresh files from wordpress.org, and reinstall plugins and themes from official sources only. Pirated (nulled) themes and plugins are a common way in, and they go.
- 03
Look for hidden code
PHP files do not belong in wp-content/uploads. Also check .htaccess, wp-config.php and index.php for injected code, and the cron jobs in your hosting account.
- 04
Check the database
Remove unknown users from wp_users, check the siteurl and home values in wp_options, and search posts for injected scripts and spam links.
- 05
Renew the security keys
New salts in wp-config.php log out every session, the attacker's included. Then set all passwords again.
- 06
Close the way in
An outdated plugin, a weak password, a forgotten old site in the same hosting account? Without that answer the attacker is usually back within days.
- 07
Update and monitor
Bring everything up to date, run a current PHP version, add a firewall such as Wordfence, and check daily for new files over the following weeks.
05 / Guides
Remove the Google warning and clear spam pages from the index
If Google has flagged your site as dangerous, request a review in the Security issues report in Search Console once the site is clean. Briefly describe what happened and what you did. Reviews usually take a few days. Only request one when the site really is clean, or the next review takes longer.
If the attacker created thousands of spam pages, those URLs should now return a 404 or 410 status. Remove them from your sitemap and resubmit the clean sitemap. It takes a few weeks for Google to forget them. If your server sent spam, check your email deliverability too, as described in our guide emails going to spam.
06 / Guides
Data protection: breach notification under Art. 33 GDPR
A hack is a personal data breach as soon as attackers could access data such as names, email addresses, orders or form enquiries. The GDPR then sets these duties (in the UK, the UK GDPR has the same 72-hour rule):
| Duty | When | Legal basis |
|---|---|---|
| Notify the data protection authority | Without undue delay and, where feasible, within 72 hours of becoming aware. Exception: the breach is unlikely to result in a risk to people | Art. 33(1) GDPR |
| Explain a late notification | If you miss the 72 hours. You may also send missing details in phases | Art. 33(1) and (4) GDPR |
| Inform the people affected | Without undue delay if the breach is likely to result in a high risk, for example passwords, payment or health data | Art. 34 GDPR |
| Keep an internal record | Always, even when you do not have to notify: what happened, the effects, what you did | Art. 33(5) GDPR |
The authority is the data protection regulator of your country: in Germany the authority of your federal state, in Portugal the CNPD, in the UK the ICO. Most have an online form for breaches. If an agency or host runs your website as a processor, they must inform you without undue delay (Art. 33(2) GDPR), but the duty to notify stays with you as the controller.
You can also report the attack to the police; cyber insurance policies often require it. This section is orientation, not legal advice. If in doubt, ask your data protection officer or a lawyer.
08 / Guides
What to tell your customers
Silence looks worse than the hack. If customers may be affected, tell them briefly, factually and without guesswork:
- What happened, in one sentence without jargon, with the date
- Which data may be affected and which is certainly not, for example because payments run through an external payment provider
- What you have already done: site cleaned, passwords renewed, authority notified
- What customers should do: change their password if they use it elsewhere, and be careful with emails in your name that ask for payment or a login
- A contact person with an email address or phone number for questions
09 / Guides
WordPress site keeps getting hacked? How to keep it clean
When a site is hacked again and again, the way in was almost always never found, or a second backdoor was missed. After that it comes down to routine: core, plugin and theme updates within days, as few plugins as possible, no pirated extensions, two-factor login for every administrator, and backups stored outside the hosting account.
If the site is old, full of abandoned plugins and structurally worn out, a clean rebuild often costs less than the third clean-up. Our article on signs you need a website redesign helps you decide. That is exactly how we work: we bring a hacked WordPress site back in an emergency and secure the data, then move it to a hand-coded website without plugin baggage as part of our web development work. We do not offer to run and maintain WordPress long-term.
FAQ
Common questions
01How do I know if my website has been hacked?
Typical signs are redirects to other sites (often only for visitors from Google or on mobile), spam pages in a site:yourdomain.com search, browser warnings, unknown administrators and a message under Security issues in Google Search Console.
02Is restoring a backup enough?
Only as a first step. The backup must date from before the attack, and afterwards you have to close the hole the attacker used. Otherwise the site is often hacked again within days.
03Do I have to report a hack to the data protection authority?
If personal data is affected and a risk to people is not unlikely, yes: without undue delay and, where feasible, within 72 hours under Art. 33 GDPR. You must record the incident internally either way. This is not legal advice.
04How long does it take to fix a hacked website?
A typical WordPress site with a clean backup is often back online the same day. Without a backup, or for large shops, the clean-up can take one to three days. Google's review after the clean-up adds a few days.
05Why does my WordPress site keep getting hacked?
Usually the way in is still open: an outdated or pirated plugin, a weak password, a forgotten second site in the same hosting account, or a backdoor that was missed during the clean-up.
06How much does hacked website repair cost?
It depends on the size of the site, the backups and the damage. We give you a fixed quote after a short call, before any work starts.