My Website Was Hacked: What to Do Right Now
Finding out your website's been hacked is stressful. Take a breath. These steps will help you limit the damage and get back on track.
Existing 3by400 client? Call us at 678-379-9321 and open a Critical ticket. See How to Get Support From 3by400.
Signs your site may be hacked
- Visitors get sent to spam, gambling, or scam sites
- Pages you didn't create, often in other languages
- Search results showing odd titles or descriptions for your site
- A browser or Google warning that the site is unsafe
- Admin users you don't recognize
- Your host suspends the site or sends a warning
- Emails from your domain bouncing or being marked as spam
What to do right now
- Don't panic-delete things. Deleting files or the whole site can destroy what's needed to find out how the attacker got in.
- Contact your host. They may see the problem from the server side and can sometimes put the site in maintenance mode or restore a backup.
- Change passwords from a clean device. Start with your hosting account, then site admin accounts, FTP/SFTP, the database, and email. Use strong, unique passwords and turn on two-factor authentication where you can.
- Check admin users. Remove any accounts you don't recognize.
- Find your most recent clean backup. Note its date. Don't restore it yet unless you know when the hack started, or you may restore the problem too.
- Write down what you see. Screenshots, URLs, and when you first noticed help whoever cleans up the site.
What to avoid
- Don't just restore a backup and move on. If the hole isn't closed, the attacker can come back.
- Don't install a pile of security add-ons at once. They can conflict and won't remove what's already there.
- Don't ignore it. Hacked sites can be flagged by search engines and browsers, which hurts traffic and trust.
Getting the site clean
A proper cleanup usually means:
- Finding and removing malicious files, code, and database entries
- Finding how they got in, often an outdated add-on, a weak password, or an old copy of the site left on the server
- Updating core and all add-ons, and removing ones you don't use
- Resetting all passwords and security keys
- Asking for a review if Google flagged the site (through Google Search Console)
- Watching the site for a while to make sure it stays clean
Preventing it next time
- Keep core and add-ons up to date
- Remove add-ons and old site copies you don't use
- Use strong passwords and two-factor authentication
- Keep regular, tested backups stored off the server
- Choose a host that takes security seriously
How 3by400 can help
We clean up hacked Joomla and WordPress sites. Afterward, our boutique hosting adds tight server and site security, nightly backups, 24/7 outage monitoring, and ongoing core CMS updates. It's available to our clients, whether we built your site or you're moving an existing one to us. We handle the whole move, including DNS. Start a project or move your site.
Start a project
Ready to talk about your website? Start a project or reach us at 678-379-9321 or