What to Do the Day Your Website Gets Hacked

September 17, 2026 · Karina Zalesova · Security

Discovering a compromise is unpleasant and the instinct is to delete the bad files and move on. That is how sites get reinfected within days: the entry point is still open and a backdoor is still sitting somewhere nobody looked.

1. Contain

Take the site offline or into maintenance mode if it is serving malware or spam to visitors.
Change passwords everywhere: website admins, hosting, database, FTP or SSH, and the email accounts used for password resets.
Rotate API keys and application passwords, which survive password changes.
Do not delete anything yet. You need the evidence to find out how they got in.

2. Preserve and assess

Take a full copy of the compromised site, files and database, and keep it aside. Then determine scope: check for unfamiliar admin users, recently modified files, scheduled tasks you did not create, and injected content in the database. Your host's logs will often show the first suspicious request and the time it happened.

3. Clean from a known-good state

The reliable method is not surgery on the infected site. It is rebuilding: reinstall the platform core, reinstall plugins and themes from official sources at current versions, and bring back only your content and uploads after scanning them. If you have a backup from before the compromise, restoring it and then immediately patching is faster and safer than manual cleaning.

4. Close the door

You are not finished until you know how they got in. The usual answers are an outdated plugin, a weak or reused password, or a compromised computer that had FTP credentials saved. Patch everything, enforce two-factor authentication, remove unused plugins and users, and check for leftover backdoors in the uploads directory, which is where they hide most often.

5. Recover your standing

Request a review in Search Console if your site was flagged.
Check whether your domain or server IP landed on a blocklist, which will affect email delivery.
Scan for content injected into old posts, which is often left behind after a superficial cleanup.

6. Notify if you have to

If customer data may have been exposed, your obligations depend on your jurisdiction and industry. Get advice quickly rather than deciding on your own, and document what you knew and when.