It usually starts with something small. A customer emails to say your site redirected them somewhere strange. Google shows a red warning page instead of your store. Your host sends a notice that your account is sending spam. However you find out, the first hour matters, and the instinct most owners have (delete everything and start over, or ignore it and hope) is usually the wrong one.
We spend a lot of time on the recovery side of security. Here’s the order we work in when a small business site gets hacked, and what you can safely do yourself before help arrives.
1. Don’t panic-delete anything
Deleting files or restoring an old backup right away feels like progress, but it destroys the evidence of how the attacker got in. If you don’t know how they got in, you can’t close the hole, and the site gets reinfected days later. Leave things as they are for now.
2. Lock the doors you can lock
A few safe steps you can take immediately:
- Change your passwords for WordPress admin accounts, your hosting control panel, FTP or SFTP, and the database, from a computer you trust.
- Check for admin users you don’t recognize under Users in WordPress. Don’t delete them yet; write down their names and when they were created.
- Turn on multi-factor login for your hosting account and your email. Attackers often get in through a reused password, not a fancy exploit.
- If you take payments, call your payment provider and ask whether anything needs to be paused. Card details shouldn’t touch your server if checkout is set up correctly, but it’s worth confirming.
3. Find out how they got in
On small business sites, the entry point is almost always one of a short list:
- An outdated plugin or theme with a publicly known vulnerability
- A plugin that’s no longer maintained, or a “nulled” premium plugin downloaded from an unofficial site
- A weak or reused admin password, with no multi-factor login
- Another site on the same hosting account that was already infected
Server access logs, file modification dates and the list of recently changed files usually tell the story. This is the step most do-it-yourself cleanups skip, and it’s why they don’t stick.
4. Clean, then close the hole
Cleanup means replacing WordPress core, themes and plugins with fresh copies from their official sources, removing injected code from the database and uploads folder, and removing backdoors (small files that let the attacker back in after you’ve “fixed” things). Then the hole that let them in gets closed: the vulnerable plugin is updated or replaced, passwords and security keys are rotated, and logins are hardened.
5. Restore only from a backup you trust
Restoring a backup can be the fastest fix, but only if you know the backup was taken before the attacker got in. Many infections sit quietly for weeks before anyone notices, which means last night’s backup may already contain the malware. This is one reason we keep backups going back further than a few days, and why we test restores before we ever need them.
6. Get off the blacklists
If Google, a browser or an email provider has flagged your site, the warning doesn’t disappear by itself once you’ve cleaned up. You request a review through Google Search Console and the relevant blocklists, and it can take a few days. Customers will keep seeing warnings until then, so this step should start as soon as the site is clean.
7. Make it harder next time
Once the site is back, the goal is to make a repeat unlikely and a recovery fast:
- A web application firewall and regular malware scanning
- Multi-factor login for every admin account
- Updates applied promptly, but tested on a staging copy first
- Off-site backups that are restored and checked on a schedule
- Uptime monitoring, so you hear about problems before your customers do
Need help right now?
If your site has been hacked, or you’re not sure whether it has, email us and we’ll take a look. You can also read more about our website security services, or ask for a free website health check so you know where you stand before anything goes wrong.