Website Hacked? Step-by-Step Recovery Guide for Business Owners

Discovering that your website has been hacked is stressful — especially when customers see spam or Google shows a warning. The good news: most small-business hacks can be cleaned and prevented. Follow these steps in order.

Common signs of a hacked site

• Google results for your site show strange titles (casino, pharma, Japanese text).
• Mobile visitors are redirected to other websites.
• Search Console shows a "Security issues" message.
• Unknown files or admin users appear.
• Hosting company suspends the account for spam or malware.
• Emails from your domain are flagged as spam.

First hour: contain the damage

1. Don't panic-delete everything. You may need evidence of what changed.
2. Change passwords: hosting panel, FTP/SFTP, database, CMS admin, email.
3. Take a backup of the current (infected) state for analysis.
4. Put up a maintenance page if visitors are being redirected.
5. Inform your developer or hosting support.

Clean the site

• Compare files with a clean backup or original source code; look for recently modified PHP files, unknown files in upload folders and code with eval, base64_decode or obfuscated strings.
• Check .htaccess files for malicious redirects.
• Check the database for injected scripts and unknown admin users.
• For WordPress: reinstall core, themes and plugins from official sources; remove nulled/pirated themes.
• Delete old test, debug and backup files left in public folders.

If you have a clean, recent backup, restoring it and then patching the vulnerability is often the fastest route.

Find how they got in

Common entry points: outdated plugins, weak admin passwords, leaked FTP credentials, vulnerable custom forms, and unprotected admin or debug scripts. If you don't close the hole, the hack returns.

Tell Google it's fixed

1. In Search Console, check the Security issues report.
2. Remove spam URLs (return 404/410) and submit an updated sitemap.
3. Click "Request review" with a description of what you fixed.

Prevent it next time

• Strong, unique passwords and two-factor authentication on hosting.
• Regular updates and automatic off-site backups.
• Password-protected admin areas; no debug files on the live server.
• Prepared statements in custom PHP code to prevent SQL injection.
• A web application firewall if available from your host or CDN.

Frequently Asked Questions

How long does hack recovery take?

Cleaning often takes a few hours to a day. Google's review of security issues typically takes days.

Will a hack hurt my SEO permanently?

Usually not, if you clean it quickly and remove spam pages. Delays can cause longer damage.

Can my hosting company clean it?

Some hosts offer malware scanning and cleanup. Custom code issues usually need your developer.

Need urgent help?

Joboo Web cleans hacked PHP and WordPress sites and secures them. Read our security tips or contact us now.