Website hacked or broken? What to do in the first hour

If your business website looks hacked or suddenly broken, do not start deleting files. Write down what you see and when, take a backup of the site as it is now, change the admin and hosting passwords from a clean computer, and call whoever looks after the site. These steps keep the evidence and stop the damage from spreading.

How do I know if my website was hacked?

WordPress.org lists the clearest signs. Any one of these is enough reason to act:

• Google, Bing or an antivirus program warns visitors that the site is unsafe.
• Your hosting company has switched the site off or sent a notice.
• Pages you did not write appear, such as Japanese text, casino or pharmacy links, or redirects to other sites.
• New admin users show up in WordPress that nobody on your team created.
• Customers say your site or your emails were flagged as spam.

A site that shows an error or a blank page may only be broken, for example after a plugin update. The first steps below are the same either way.

What should I do first?

1. Note the time, what you saw and the address of the page. A screenshot from your phone is fine.
2. Do not open the infected pages again on your office PC. Google warns that some hacked pages try to attack the visitor's browser.
3. Make a full backup of the site and database in its current state, before anyone cleans it. It is the record of what happened.
4. Scan the computers used to log in to the site. WordPress.org notes that many hacks start with a stolen password from an infected PC.
5. From a clean device, change the passwords for WordPress admin, hosting control panel, FTP and the database. Turn on two-step login where you can.
6. Tell your hosting provider. They can see whether other sites or your email were affected.

What should I not do?

• Do not delete the whole site or reinstall over it before a backup exists. You lose the evidence and often your recent content.
• Do not restore an old backup without fixing the hole first. The attacker usually comes straight back in through the same plugin.
• Do not ignore it because the home page looks fine. Hacks often hide on pages only Google sees.

How do I remove the Google warning?

Open Google Search Console and check the Security issues report. Google lists sample pages and the type of problem. Once every page is clean, click Request review and describe what you fixed. Google says the review may take days or even weeks, so clean the whole site before you ask.

What to do now

1. Forward this page to the person or company that maintains your website.
2. Check that your site is added to Google Search Console, so you get warned early next time.
3. Remove plugins and themes you no longer use, and keep the rest updated every week.
4. Keep at least one recent backup stored away from the website itself.

How SyncTech can help

If your site is down or showing pages you did not create, our website repair and maintenance service can check it, clean it and keep plugins up to date after. Our help centre shows how to reach the support team quickly.

Source and credit

We are sharing guidance from WordPress.org and Google. This guide is written by Synctech in our own words.

• FAQ My site was hacked, WordPress.org documentation, retrieved 1 November 2026: https://wordpress.org/documentation/article/faq-my-site-was-hacked/
• Security issues report, Google Search Console Help, retrieved 1 November 2026: https://support.google.com/webmasters/answer/9044101
• Help, I think I've been hacked, web.dev by Google, retrieved 1 November 2026: https://web.dev/articles/hacked Retrieved 1 November 2026. WordPress, Google and Bing are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.