Signs your site has been hacked
- Visitors, often only on mobile or from Google, are redirected to other websites
- Pages, links or products appear that you did not create, often in Japanese or about pharmacy or casinos
- Google shows “This site may be hacked” or a red warning screen
- Your host has suspended the site or emailed you about malware
- Unknown administrator accounts in WordPress or Drupal
- Your domain is sending spam email
If any of these sound familiar, email [email protected] and we will treat it as urgent.
How we clean a site
- Contain. Take a full copy for evidence, put the site into maintenance mode if needed, and lock down admin access.
- Find the infection. Compare core files with clean originals, scan themes, plugins and uploads for injected code, and check the database for spam content and rogue users.
- Find the way in. Usually an out-of-date plugin, theme or core, a weak or reused password, or an abandoned file left on the server.
- Clean. Replace core with clean copies, remove injected code and spam, delete rogue users and backdoors.
- Close the gap. Update or replace the vulnerable software, rotate every password and secret key, and harden file permissions and security headers.
- Recover. Request reviews from Google and, where needed, blocklist operators, and confirm the host lifts any suspension.
Included
- Malware and spam removal from files and database
- Identifying and closing the entry point
- Password and secret key rotation, with clear instructions for you
- Hardening: updates, file permissions, security headers
- Google Search Console review request
- A written report of what happened and what was fixed
Works with
WordPress, Drupal 7 to 11, and custom PHP sites, on shared hosting, VPS or cloud servers.
To stop it happening again, see our WordPress security checklist or ask us to keep your site up to date.
Questions we are asked
How do I know my site has been hacked?
Common signs are visitors being redirected to other sites, spam pages or links you did not create, Google showing "This site may be hacked" or a red warning, unknown admin users, emails from your host about malware, or the site suddenly sending spam email.
What should I do first?
Email [email protected] so we can treat it as urgent. Do not delete files at random or restore an old backup yet; the evidence of how the attacker got in is useful. Do not send passwords by email; we will send you a secure way to share access.
Will restoring a backup fix it?
Sometimes, but often the backup already contains the infection, or the same hole is used again within days. A clean-up only lasts if the way in is found and closed.
Can you get my site off Google's warning list?
Once the site is clean we request a review in Google Search Console. Reviews for hacked sites usually take a few days.
Tell us about your site. You get one fixed price, or a few questions first, within 2 business days.
Request a quote