A hacked website is an incident, not a maintenance backlog. Strange redirects, warning pages in Google, spam content you never published, customers reporting odd behaviour — these mean someone else has access to your site right now, and every hour it stays compromised costs trust, enquiries, and possibly your search presence. This page covers the one-off recovery engagement: containment, cleanup, root cause, and verified recovery. For the ongoing discipline that prevents the next incident, see website security maintenance.
Signs Your Site Has Been Hacked
| Symptom | What it usually means |
|---|---|
| Visitors redirected to spam or gambling sites | Malicious code injected into the site, often only triggered for certain visitors or devices |
| Google shows a "this site may be hacked" warning | Google has detected the compromise — search traffic drops sharply until it is cleared |
| Pages or posts you never published | Attackers using your site to host spam content for their own search rankings |
| Site suddenly slow or the hosting bill spikes | The server is being used for something else — spam sending, crypto mining, or attack traffic |
| Admin users you did not create | The attacker has persistent access and can return even after visible cleanup |
| Customers report strange emails "from you" | The compromise may extend to email or contact data — treat this as urgent |
The First 30 Minutes: What to Do Right Now
- Do not delete everything in a panic. Evidence of how they got in is valuable — a wiped site with an unfixed entry point gets hacked again within days.
- Change passwords. Hosting, site admin, FTP, and database passwords — from a clean device, in case the compromise includes your own machine.
- Take the site offline or into maintenance mode if visitors are being redirected to malicious pages. A visibly hacked site loses more trust per hour than downtime does.
- Check whether you have a clean backup — one from before the hack, verified, not just the most recent one. Do not restore it yet; a backup restored onto an unfixed vulnerability is just a slower way to get hacked again.
- Call for help. Incident recovery is time-sensitive work with a specific order of operations — this is the moment to bring in someone who does it regularly.
The Recovery, Phase by Phase
1. Containment
Stop the bleeding: take the site offline or isolate it, block the attacker's access, preserve evidence of the entry point. The goal is a site that cannot be further damaged while the work proceeds.
2. Cleanup
Remove the malicious code, injected content, and unauthorised admin accounts. This is done against a known-clean baseline — core files verified, themes and plugins reinstalled from trusted sources — because surface-level deletion misses backdoors, and missed backdoors mean reinfection.
3. Root cause
Identify how they got in: unpatched plugin, weak password, compromised hosting account, vulnerable theme. This is the phase most cheap "cleanups" skip — and the reason hacked sites get hacked again. The entry point is closed before the site goes back live.
4. Verified recovery
The cleaned site is scanned, tested, and monitored over a settling period. Google's hacked-site flag, if present, is addressed through their review process once the site is genuinely clean. Only after verification does the site fully return to service.
After Recovery: Staying Clean
Recovery removes the current compromise; it does not prevent the next one. The same neglected updates and weak access controls that allowed this incident will allow another. The ongoing discipline — patching cadence, login hardening, monitoring, verified backups — is website security maintenance, a separate standing arrangement. A recovery engagement should end with a plain-language report of what happened and what to change so it does not repeat.
Timeline and Cost Guidance
Most single-site recoveries take two to five working days: containment is same-day, cleanup and root-cause work follows, and the verification period adds a few days of monitoring. Complex cases — e-commerce sites, multi-site infections, compromised customer data — take longer.
Recovery is scoped per incident: site size, infection depth, and whether customer data is involved all change the work. Be wary of anyone offering a flat "hack removal" price without examining the site first — the entry point and the infection depth cannot be known before the investigation, and the quote should say so.
Mistakes That Make It Worse
- Restoring a backup onto the same vulnerability — the fastest route to a second hack
- Deleting files before identifying the entry point — destroys the evidence needed to close it
- "Cleaning" by deleting visible spam only — backdoors stay, and the site is reinfected within days
- Ignoring the Google warning — search traffic does not recover until the flag is cleared
- Changing nothing afterwards — the same neglect that allowed the hack invites the next one
Questions Worth Asking
- How will you identify the entry point, not just remove the symptoms?
- Will you work on an isolated copy, and how do you verify the cleanup is complete?
- What does the post-recovery report include?
- How do you handle the Google hacked-site flag if one is present?
- What should change afterwards to prevent recurrence?
Related Services
Recovery is the incident; website security maintenance is the ongoing prevention. General upkeep — updates, backups, fixes — is website maintenance.
Frequently Asked Questions
Should I just restore from backup?
Only if the backup is from before the hack, verified clean, and restored after the entry point is closed. Restoring a recent backup onto an unfixed vulnerability just reinstates the hack — often within days. The backup is a tool in the recovery, not the recovery itself.
How do I know the hack is fully removed?
Through verification, not assumption: core files checked against known-clean versions, themes and plugins reinstalled from trusted sources, unauthorised accounts removed, and scans run after cleanup — followed by a monitoring period to catch reinfection. Ask any provider to describe their verification step; if they do not have one, keep looking.
Will my Google rankings recover?
If Google flagged the site, traffic stays depressed until the site is genuinely clean and the flag is cleared through Google's review process. Rankings generally recover once the flag is lifted and the site is stable, but the timeline depends on Google's systems — nobody can promise a specific recovery date.
Do I need to tell my customers?
If customer data — contact details, order information, anything beyond public content — may have been accessed, take it seriously and get proper advice. If the compromise was limited to defacement or spam injection with no data access, a quiet, thorough cleanup is usually sufficient. When in doubt, err toward disclosure.
Can a hacked site be fixed without rebuilding it?
Usually yes. Cleanup against known-clean baselines plus closing the entry point resolves most incidents without a rebuild. A rebuild becomes the honest recommendation only when the infection is so deep — or the platform so outdated — that verified cleanup costs more than starting clean.
Start the Recovery Now
Incidents get worse with time, not better. Contact Tirupati Technologies for incident recovery — containment first, then cleanup, root cause, and verified recovery.