How you find out
Rarely from the site itself. A customer says your site sent them to a pharmacy page. Google Search Console emails to say the site has been flagged. Your hosting company suspends the account for sending spam. The browser shows a red warning screen before your own home page. Or the site is simply slow and odd, and nobody can say why.
However it arrives, the first day matters, and doing the right things in the right order is the difference between a bad afternoon and a bad month.
Hour 1: do not panic, and do not start deleting
The instinct is to log in and start removing things. Resist it for an hour. A compromised site is evidence: what was changed, when, and how the attacker got in. Delete first and you lose the trail, and you will likely miss the second back door that lets them straight back in.
Instead, write down what you observed and when. Take screenshots of the warning, the redirect, the strange pages. Note the date of the last known good state.
Hour 2: contain
Change every password that touches the site: hosting account, database, admin users, FTP or SFTP, the domain registrar, and the email account that receives password resets. Use new, long, unique passwords. If the attacker still has a way in, this closes the obvious ones.
Put the site in maintenance mode or take it offline if it is actively harming visitors, redirecting them or serving malware. A "back shortly" page is better than a browser warning, and it stops the damage while you work.
Tell your host. They see attacks across thousands of sites and often know the pattern already. They may have logs you cannot see.
Hour 3: back up the compromised site
Yes, the compromised one. Full files and database, downloaded and kept. It is the evidence, and if the cleanup goes wrong you need to be able to go back to a known state, even a bad one, rather than to nothing.
Then find the most recent clean backup, from before the compromise. Check the dates against what you wrote down in hour one. This is the backup you may restore from.
Hours 4 to 8: find the way in
Someone with access to the server looks for:
- Files modified recently that should not have been, especially in the platform core, the theme, and the uploads folder where executable files should never exist.
- Unknown admin users in the database.
- Plugins or themes that are out of date with known vulnerabilities, or that nobody installed.
- Scheduled tasks the attacker created to reinstall themselves.
- Server access logs around the date of compromise, showing which URL was hit and how.
The way in is almost always one of three: an outdated plugin with a published vulnerability, a weak or reused password, or a compromised computer belonging to someone with access. Knowing which decides what "prevent" means later.
Hours 8 to 16: clean
Two approaches, and the second is usually better.
Clean in place. Remove the malicious files, restore modified core files from the official source, delete unknown users, remove injected code from the database. This is fine for a small, well-understood compromise, and risky otherwise, because a missed file reinfects the site within days.
Restore from a clean backup and patch. Restore the last known good backup, immediately update everything to current versions, change all passwords again, and re-apply only the content changes made since the backup. Cleaner, because you are not hoping you found everything.
Either way, scan the result with a reputable malware scanner and compare core files against the official checksums before bringing the site back online.
Hours 16 to 24: bring it back and tell Google
Put the site live. Request a review in Google Search Console if the site was flagged; removing the warning takes Google a day or more after you ask. Check the site from a phone on a different network, follow every internal link, and watch the logs for the next few days for the attacker knocking on the same door.
Preventing the next one
The compromise happened because something was not being watched. The fix is that something watches it:
- Updates applied promptly, on a staging copy first.
- Abandoned plugins removed.
- Strong unique passwords and two-factor authentication on admin and hosting accounts.
- A firewall in front of the site, and admin login rate-limited.
- Daily backups kept off the server, and tested.
- Malware and file-change scanning that alerts a human.
That list is what a care plan is. A hacked site is nearly always an unmaintained site, and the cleanup costs more than years of the plan that would have prevented it.
If you are in the first hour now
Change the passwords, take the site offline if it is hurting visitors, and back it up before anyone deletes anything. Then get someone who has done this before, because the difference between a clean recovery and a reinfection is knowing where to look. We do this as rescue work, and the first question we ask is what you wrote down in hour one.