Hacked Website Recovery: A Complete Guide to Regaining Control

Around 30,000 websites are hacked every day. This guide walks through the full recovery process — from spotting the first signs of compromise to hardening the site against repeat attacks.

Imagine the situation — you open your website and, instead of the familiar home page, you are met by a malware warning, a redirect to a suspicious site, or simply a blank page full of unintelligible code. This scenario is not just a theoretical threat: roughly 30,000 websites are hacked worldwide every day, and that number keeps climbing as attack methods evolve and become automated. Whether your site is a small personal blog, a local company's brochure page or a large e-commerce store, the risk of being hacked is always there, and how quickly and how correctly you respond to such an incident can decide whether your online presence is back within a few days or whether you lose a reputation built over months, along with customer trust and your search engine rankings.

In this article we will walk through the entire recovery process for a hacked website in detail — from the first signs of compromise all the way to the long-term security strategy that helps prevent repeat attacks. We will cover both the technical side and the practical steps any site owner can take, even without deep programming knowledge.

How to tell that your website has been hacked

One of the biggest challenges site owners face is that a hack is not always obvious — many attacks are deliberately built to stay unnoticed for as long as possible, because it is more profitable for attackers to quietly consume your server resources, distribute malware through your site, or inject hidden links and spam content that lifts the search rankings of their own sites. There are, however, several signs that deserve immediate attention, because they often indicate that your site has been compromised.

The first and most visible sign is a browser or search engine warning — if Google Chrome or another browser shows a red warning page reading "This site may harm your computer" or something similar, it almost always means that Google has detected malicious content on your page and added it to its blacklist. A warning like that scares visitors off instantly and can cut your traffic by 90% or more, which makes it one of the most serious consequences of a hack. Likewise, a "This site may be hacked" label can appear under your address in Google search results, which has a significant effect on click-through rates and user trust.

The second common sign is unexpected redirects — if visitors to your site are automatically sent to other pages, especially suspicious sites with adverts, pharmaceutical products or adult content, that is a clear signal that malicious code performing those redirects has been injected into your site. Such redirects are often configured to fire only for certain users, for example only on mobile devices or only for visitors arriving from search engines, which makes the problem even harder to spot, because an administrator who opens the page directly may see nothing out of the ordinary.

The third sign, and one that is often ignored, is unusual changes to the site's content — if content you did not create suddenly appears on your pages, such as links to unfamiliar sites, new user accounts in the admin panel, unknown files in server folders or changes to existing files, all of it points to unauthorised access. Particularly dangerous are the cases where attackers create hidden pages on your site that are optimised for search engines and filled with spam content — this tactic, known as "SEO spam" or a "pharma hack", can damage your site's reputation in the eyes of search engines for a long time, even if you never see those pages yourself, because they are served only to search engine crawlers.

The fourth sign is server performance problems — if your website suddenly becomes noticeably slower, the server keeps going down, or you start receiving notices from your hosting provider about excessive resource consumption, it may mean that attackers are using your server for their own purposes, such as cryptocurrency mining, sending spam or launching attacks on other sites. In cases like these the hosting company may even suspend your account, which means your site becomes completely unavailable.

The most common types of hack and the vulnerabilities behind them

To recover a hacked site effectively and prevent repeat attacks, it is important to understand how attackers get into your system in the first place, because without that understanding you risk fixing only the symptoms rather than the cause, and the site can be hacked again within days or weeks of being cleaned. Cybersecurity statistics show that the majority of hacks are not sophisticated, targeted attacks but automated processes in which bots scan millions of sites looking for known vulnerabilities and exploit them the moment they find one.

SQL injection is still one of the most widespread and most dangerous attack techniques. It lets an attacker manipulate your site's database by submitting malicious SQL queries through input fields such as login forms, search boxes or URL parameters. If your site's code drops user-supplied data straight into SQL queries without proper validation and parameterisation, an attacker can bypass authentication and read, modify or delete sensitive data from the database, including user passwords, personal information and financial records. SQL injection attacks are especially dangerous because they can hand an attacker full control over your database, and in some cases over the entire server if the database user has excessive privileges.

Cross-Site Scripting, or XSS, is another widespread vulnerability which, unlike SQL injection, targets not the server but the site's users — an attacker injects malicious JavaScript into your site that runs in visitors' browsers, making it possible to steal session cookies, redirect users to fraudulent pages, or perform actions on a user's behalf without their knowledge. XSS attacks can be stored (where the malicious code is saved in the database and served to every visitor), reflected (where the code travels in a URL parameter and only fires when a user clicks a specially crafted link) or DOM-based (where the vulnerability lives entirely in client-side code). Effective protection against XSS involves output encoding, input sanitisation and a Content Security Policy (CSP) that restricts the sources scripts may be loaded from.

Outdated software is another extremely common cause of hacks, and it is especially relevant in the WordPress ecosystem, where research shows that roughly 99% of WordPress vulnerabilities relate to third-party plugins and themes rather than to the WordPress core itself. When a plugin or theme developer finds and fixes a security vulnerability, they publish an update — but at the same moment the details of that vulnerability become public, and attackers immediately start hunting for sites that have not been updated yet. That window between disclosure and patching is one of the most critical periods for your site's security. This is precisely why regular software updates are not simply good practice but an absolute necessity.

Weak or compromised passwords remain one of the easiest routes attackers take into a site, because many administrators pick easily guessable passwords, reuse the same password across several services, or skip multi-factor authentication, which makes brute-force and credential-stuffing attacks extremely effective. The situation is made worse by the fact that many people use the same email address and password for their hosting account, their FTP access and their site's admin panel, which means that compromising a single password can hand an attacker the keys to the entire infrastructure.

Step by step: the recovery process for a hacked website

Once you have established that your website has been hacked, it is extremely important to act methodically and in sequence rather than panicking and deleting files or reinstalling everything from scratch, because chaotic action can destroy the evidence needed to identify the source of the attack, and can even make things worse if you fail to close every backdoor the attacker left behind. What follows is a structured recovery process based on cybersecurity industry best practice and recommended by hosting companies and security experts alike.

Stage one: immediate isolation and preserving the evidence

The very first step to take immediately after discovering a hack is to isolate the site from the outside world, so that no further harm comes to your visitors or to your reputation. The simplest way to do that is to switch on maintenance mode, which shows visitors an informative notice that the site is temporarily unavailable while blocking access to everything else. If you cannot reach the site's admin panel, you can use the .htaccess file to redirect all traffic to a simple HTML page carrying that notice, or ask your hosting provider to suspend your account temporarily.

At the same time as isolating the site, it is critically important to create a full backup of the compromised site — all of the files and the database. This backup serves two purposes: first, it preserves the evidence that may be needed to identify the source and method of the attack, and second, it gives you a safety net in case the recovery process fails and you have to return to the original state and try a different approach. Under no circumstances should you start cleaning before this backup exists, because otherwise you risk losing both the infected files (which may be needed for analysis) and potentially clean files if something goes wrong during the clean-up.

The third important step at this stage is to contact your hosting provider, because they have access to the server log files, which can yield valuable information about when and how the attack happened, which files were modified and which IP addresses the unauthorised access came from. What is more, if your account sits on a shared server, the hosting company needs to check whether the attack has affected other accounts on the same machine and take appropriate measures to contain the problem.

Stage two: identifying and removing the malicious code

Once the site is isolated and the backup has been made, the most critical phase of recovery begins — finding and removing the malicious code. This process demands thoroughness and a systematic approach, because attackers frequently leave several backdoors in different parts of a site, and even one overlooked backdoor means the attacker can come back at any moment.

The first step is an automated scan with trusted security tools such as Wordfence, Sucuri or MalCare, which check every file and the database for known malware signatures, suspicious functions and unauthorised changes. These tools catch the majority of common infections, but they are not infallible, which is why an automated scan must always be backed up by a manual review. During that manual review, pay particular attention to critical files such as .htaccess, wp-config.php (in the case of WordPress), functions.php, header.php and footer.php, because these are the most frequently targeted, and code injected into them may be disguised with obfuscation techniques such as base64 encoding, the eval() function or gzinflate() calls, which make malicious code hard to recognise with the naked eye.

Cleaning the database is every bit as important as cleaning the files, because attackers often inject malicious content straight into database tables — in WordPress the wp_posts and wp_options tables are the ones most commonly affected, and they can be seeded with spam content, hidden links or even PHP code that executes when the site loads the relevant records. You can inspect the database with phpMyAdmin or a similar tool, looking for suspicious records, unauthorised administrator accounts and unusual changes in the options table.

Once the malicious code has been identified, the recommended practice is not to try to repair the infected files but to replace them with clean, original copies — in WordPress that means downloading a fresh WordPress core from wordpress.org and overwriting the wp-admin and wp-includes directories, as well as reinstalling every plugin and theme from official sources. If you have custom code in a theme or plugin, compare it line by line against a clean version, so that you identify and remove only the malicious changes while keeping your legitimate modifications intact.

It is especially important to check the folders that should never contain executable files, such as the wp-content/uploads directory on WordPress sites — if there are PHP files in that folder they are almost certainly malicious, because the folder is meant only for images and other media files. You should also go through the site's root directory looking for unknown files that could be backdoors or attacker tooling.

Stage three: rotating credentials and hardening the system

Once the malicious code has been removed, it is absolutely essential to change every password and access key associated with your site, because there is a strong chance that the attacker obtained those credentials during the hack, and if they are not changed the attacker can simply log back in and compromise your site all over again. The password change has to cover every level: the site's administrator accounts (and every other user account with elevated privileges), the hosting control panel password, FTP and SFTP credentials, the database password, and the passwords of any email accounts associated with the site.

WordPress sites also need the security keys and salts in wp-config.php refreshed, because those keys are used to encrypt sessions, and replacing them automatically terminates every active session, including any an attacker might be using. New keys can be generated with the official WordPress key generator and simply pasted into wp-config.php in place of the old values.

Hardening the system also means updating every software component to its latest version — that covers the CMS core, all plugins, themes and server-side software such as the PHP version. Every unused or abandoned plugin and theme must be deleted outright rather than merely deactivated, because even a deactivated plugin with a vulnerability can be exploited while its files are still on the server. Particularly dangerous are the so-called "nulled" or pirated plugins and themes, which frequently ship with malicious code already embedded and are among the most common causes of hacked sites.

On top of changing passwords and updating software, you also need to put proactive security measures in place that will significantly reduce the risk of further attacks. A Web Application Firewall (WAF) is one of the most effective defences, because it filters incoming traffic and blocks suspicious requests before they ever reach your site, protecting against SQL injection, XSS, brute-force attacks and many other threat types. Multi-factor authentication (MFA or 2FA) is another critically important layer of security: it means that even if an attacker obtains your password, they cannot log in without the second authentication factor, such as a code from a mobile app or an SMS.

For WordPress sites it is also advisable to disable file editing from the admin panel by adding the line define('DISALLOW_FILE_EDIT', true) to wp-config.php, which stops an attacker who has gained access to an administrator account from editing theme and plugin files directly through the WordPress interface. It is equally sensible to limit the number of login attempts, change the default administrator username and restrict access to the wp-admin directory by IP address wherever that is practical.

Stage four: restoring your reputation with search engines

If your site has been added to Google's blacklist, or hacking warnings appear in search results, the recovery process is not finished until those warnings have been removed, because they carry on scaring visitors away and damaging your SEO positions even after the site has been fully cleaned and hardened. Google Search Console is the main tool for this stage, and if you have not verified your site on that platform yet, now is the last moment to do it.

The "Security & Manual Actions" section of Google Search Console holds the "Security Issues" report, which shows exactly which problems Google has found on your site, which pages are affected and what kinds of threat have been identified. Once you have completed all the cleaning and hardening steps described above, you can click the "Request Review" button, which tells Google that the problem has been fixed and asks for the warnings to be lifted. The request must include a detailed account of what the problem was, which specific steps you took to fix it and what the results of those actions were — the more detailed and specific your account, the better the chance that the review will be completed quickly and successfully.

Google usually completes a review within a few days, although in more complicated cases it can take up to two weeks. It is worth noting that hacked pages containing spam content should not be redirected to the home page or to other parts of the site — instead they should return a 404 (Not Found) status code, so that Google gradually drops them from its index. A redirect in this situation can be read as an attempt to hide the problem rather than solve it.

Beyond Google Search Console it is worth checking other blacklists as well, such as Norton Safe Web and McAfee SiteAdvisor, because some browsers and security products use these lists in addition to Google's, and if your site appears on any of them you will need to submit a separate request to each service.

Backup strategy: your safety net

Regular, reliable backups are one of the most important preventive measures any site owner can put in place, because even in the worst case — when a site is so badly compromised that cleaning it is neither practical nor economically justified — you can restore the site from a clean backup and lose only the content added since that backup was made. A backup strategy does have to be thought through, though, because badly organised backups can turn out to be worthless at exactly the moment they are needed most.

First, backups have to cover both all of the site's files and the database, because a site without its database, or a database without its files, is useless — both components are needed to restore the site's functionality in full. Second, backups must be stored off the server that hosts your site, because if the server is compromised an attacker can delete or infect backups that live on the same machine. Ideally, backups are kept in at least two different places, for example in cloud storage (Google Drive, Amazon S3, Dropbox) and on local media.

Third, it is important to keep several backup versions rather than just the most recent one, because if a hack is discovered late the newest backup may already be infected and you will need an older, clean version. The recommended practice is to retain at least 30 days of backup history, which lets you go far enough back to find a clean version even if the hack was discovered several weeks after it began.

Fourth, the backup process has to be automated, because manual backups are unreliable — people forget, postpone, or simply stop doing them after a while. Most hosting providers offer automated backups, and there are also dedicated plugins and services that handle the job. It is equally important to verify periodically that the backups actually work, by restoring the site from a backup in a test environment, because nothing is worse than discovering in the middle of a crisis that your backups are corrupted or incomplete.

The reality of the cybersecurity landscape: statistics and trends

To grasp fully how serious the threat of being hacked is, and why investing in security is not merely advisable but economically justified, it is worth looking at a few statistics that characterise the current cybersecurity landscape. The global cost of cybercrime reached approximately 9.5 trillion US dollars in 2024, and forecasts suggest that by 2025 the figure will grow to 10.5 trillion dollars a year, which makes cybercrime one of the largest economic problems in the world. The average cost of a data breach exceeded 4.88 million dollars per incident in 2024, covering direct losses, investigation costs, reputational damage and lost customers.

The frequency of attacks continues to grow exponentially — Amazon reported that in 2024 the number of potential threats it observed rose from 100 million to 750 million a day in the space of just six months, which illustrates how rapidly attack automation and scaling are developing. The number of DDoS attacks in the first half of 2024 rose by 46% compared with the previous year, and ransomware attacks reached roughly 20 to 25 serious incidents a day.

Healthcare has become one of the most heavily targeted sectors, seeing a 32% increase in weekly attacks in 2024 compared with 2023, reaching an average of 2,018 attacks per organisation per week. The human factor remains one of the biggest vulnerabilities — phishing accounts for 39.6% of all email threats, and many serious attacks start with an employee accidentally downloading a malicious file or clicking a fraudulent link.

The use of artificial intelligence in cyberattacks has become a new and worrying trend — attackers are turning to AI to improve how they discover and exploit vulnerabilities, produce more convincing phishing messages and run more sophisticated social engineering attacks. Deepfake attacks have been experienced by 47% of organisations, and synthetic identity fraud now accounts for more than 80% of new account fraud cases.

Long-term security strategy: a proactive approach

Recovering a hacked site is only half the story — it is just as important, if not more so, to build a long-term security strategy that significantly reduces the risk of being hacked again and keeps your site as well protected as possible against constantly shifting threats. That strategy is not a one-off exercise but a continuous process, one that demands regular attention and investment of resources.

Regular vulnerability scanning and penetration testing are among the most important elements of proactive security, because they let you identify and close security gaps before attackers exploit them. Vulnerability scanning can be handled by automated tools that check your site on a schedule and report the problems they find, whereas penetration testing is a deeper exercise in which a security specialist tries to break into your site using the same methods a real attacker would, in order to identify vulnerabilities that automated tools may miss.

Access control and privilege management is another critical security aspect that often gets ignored — every user on your site should hold only the minimum permissions needed to do their job, and nobody should be using an administrator account for everyday work such as publishing content or moderating comments. This idea, known as the principle of least privilege, significantly limits the potential damage if one of the accounts is compromised.

Security monitoring and log analysis is a continuous process that lets you spot suspicious activity early and act on it before it turns into a full-blown breach. It involves reviewing server access logs regularly, monitoring failed login attempts, checking file integrity (which alerts you if a file is modified without your knowledge) and analysing network traffic for unusual patterns that could point to an attack or a data leak.

Drawing up an incident response plan is another important step that many small and medium-sized business owners ignore, assuming it is only necessary for large corporations. In reality, any organisation that depends on its online presence should have a documented plan describing what to do in the event of a hack, who is responsible for each step, how to communicate with customers and partners, and how to restore normal operations as quickly as possible. Having such a plan significantly shortens response time and prevents chaotic decisions in a crisis. Some of these choices are made when the site is first commissioned — we have written a separate article on the mistakes that cost the most at that stage.

Professional help: when it is time to call in specialists

Although a site owner can carry out many of the recovery steps themselves, there are situations in which professional help is not merely advisable but necessary to guarantee a complete and safe recovery. If the hack has been particularly complex, if the site is hacked again after being cleaned, if there is any suspicion of a data breach involving customers' personal information, or if you simply do not have the technical knowledge and the time to work through every required step, it is worth considering whether to bring in cybersecurity specialists or turn to dedicated website security services.

Professional security services such as Sucuri, Wordfence or MalCare offer both automated cleaning tools and hands-on expert help, and many of them also provide ongoing monitoring and protection after recovery. The cost of such services is usually far lower than the potential losses from a prolonged compromise — lost traffic, declining customer trust, potential legal consequences in the event of a data breach, and the time spent trying to solve the problem yourself without sufficient knowledge.

If your site processes personal data and a breach has occurred, you may also have a legal obligation to notify the relevant supervisory authorities and the individuals affected under the General Data Protection Regulation (GDPR) or other applicable legislation, and in that case it is especially important to document the entire recovery process and keep evidence of the measures you took.