What to do if your website gets hacked

Websites are attacked all the time, usually by automated programs looking for out-of-date software or weak passwords. If it happens to you, stay calm and work through these steps.

Signs your site may be hacked

• You are redirected to another site, or see strange pop-ups.
• Google warns visitors that the site may be harmful, or shows odd text in your search listing.
• Pages or links you did not create appear.
• You cannot log in, or new, unknown users appear.
• Your host tells you the site has been suspended for malware.

What to do

1. Tell your host or developer straight away. If we look after your site, ring or email us. We can usually restore a clean copy quickly.

2. Do not delete everything. Evidence helps find how the attacker got in. Let your host or developer take a copy first.

3. Restore a clean backup. Return the site to a copy from before the attack. This is why tested backups matter. See backups: how to know yours work.

4. Update everything. Update WordPress, the theme and all plugins, and remove any you do not use.

5. Change all passwords. This includes your website admin users, hosting account, email, database and anything else connected. Use long, unique passwords and turn on two-factor authentication. Remove unknown users.

6. Scan and clean. Run a security scan to check no hidden files remain.

7. Check Google. If Google flagged your site, request a review in Search Console once it is clean.

8. Check your email. If your email may be affected, change that password too and warn customers if you think they received strange messages from you.

If personal data may be involved

If customers’ personal data may have been exposed, the law may require you to report a serious breach to the Information Commissioner’s Office within 72 hours. Contact the ICO at ico.org.uk for guidance.

Prevention

Keep software updated, use strong passwords, limit logins and have working backups. See how to check your website is secure and website maintenance.