Website Hacked? What to Do Next and How to Tell

Website hacked? Take the site offline, change every password, restore a clean backup or remove the malware, update everything, then ask Google to recheck the site. Work in that order, keep a copy of the hacked site for investigation, and get help early if customer data may be involved. This guide covers how to tell, what to do and how to stop it happening again.

How do you know if your website has been hacked?

Many owners find out from someone else: a customer, Google or their web host. These are the common signs that a website has been hacked:

• Google shows “This site may be hacked” under your listing, or browsers show a red warning page before your site loads.
• Visitors are redirected to another site, sometimes only on phones or only when they arrive from Google.
• Pages you didn’t create appear in Google (often spam about pills, loans or in another language).
• New admin users, files or plugins you don’t recognise.
• Your host suspends the account, or your emails start bouncing or landing in spam.
• A sudden, unexplained drop in traffic or search rankings.

How do you check if your website is hacked?

Run these four checks to answer “is my website hacked?” before you call anyone:

1. Search Google for site:yourdomain.com.au and scroll through the results for pages or titles you don’t recognise.
2. Open the Security issues report in Google Search Console. If Google has found hacked content or malware, it’s listed there (Google’s Security issues guide).
3. Check your site’s status in Google’s Safe Browsing site status tool.
4. Log in and look at users, plugins and recently changed files. A security plugin or your host’s malware scanner can scan the files for you.

If none of these show a problem but something still feels wrong, ask your web developer or host to look at the server logs.

Can a website be hacked even if it’s small?

Yes. Many attacks are automated: bots scan thousands of sites for known weaknesses, so a small local business website is just as likely to be found as a big one. Attackers often want your site for what it can do (send spam, host scam pages, redirect visitors) rather than for your business itself. A website hacked this way is rarely personal.

How do websites get hacked?

When a website got hacked, the cause is usually one of these:

• Out-of-date software. Old versions of WordPress, plugins or themes with known security holes are a common way in.
• Weak or reused passwords for the website, hosting or email, especially without two-factor authentication.
• Pirated (“nulled”) themes and plugins that come with malicious code already inside.
• Abandoned plugins that the developer no longer updates.
• Stolen logins from a phishing email or an infected computer.
• Poorly secured hosting, where one infected site on the server can affect others.

What can happen if your website is hacked?

The damage depends on what the attacker wants, but these are the usual consequences:

• Spam and redirects: hidden links or redirects that send your visitors to unrelated sites, often to earn the attacker money.
• Lost traffic and sales: Google may warn searchers or drop your pages until the site is clean, and downtime turns customers away.
• A suspended hosting account: many hosts suspend an infected site until it’s cleaned.
• Stolen data: customer details, logins or payment information taken from forms or the database.
• Phishing in your name: scam emails sent to your customers that look like they came from you.
• A defaced website: your pages replaced with the attacker’s own message.
• Damage to trust: customers may hesitate to come back, and if personal information is exposed you may have obligations under the Privacy Act (see step 7 below).

Much of this can be avoided with routine maintenance, which is also why it pays to act quickly when something does go wrong.

What to do if your website is hacked

If you’re thinking “my website is hacked” right now, work through these steps in order. If someone manages the site for you, call them first, because they may be able to restore a clean backup quickly.

1. Don’t panic, and don’t delete everything. Take a copy of the hacked site and its database first, so you or a specialist can work out how they got in.
2. Take the site offline or into maintenance mode so visitors don’t land on infected pages. Your host can do this if you can’t log in.
3. Change every password linked to the site: website users, hosting, the database, SFTP and email. Turn on two-factor authentication and remove any users you don’t recognise.
4. Remove the malware. Restore a clean backup from before the hack, or scan and clean the files and database with a security plugin or a specialist. Reinstall WordPress, plugins and themes from their official sources.
5. Close the hole. Update everything, delete plugins and themes you don’t use, and fix whatever let the attacker in, or the same hack will come back.
6. Ask Google to recheck the site. Once it’s clean, request a review in Search Console’s Security issues report so warnings are removed from your listing.
7. Report it and check your obligations. You can report cybercrime to the Australian Cyber Security Centre through cyber.gov.au or call 1300 CYBER1 (1300 292 371). If personal information may have been accessed, check whether the Notifiable Data Breaches scheme applies to your business; the OAIC explains who must notify and when.
8. Keep watching for a few weeks. Check Search Console, your users and your files again, because some infections leave a back door behind.

If you’d rather hand it over, our website repair service covers how to fix a hacked website for you: we diagnose the problem, quote the work and get the site back online.

How do you stop your website getting hacked again?

Prevention is mostly routine maintenance:

• Update WordPress, plugins and themes regularly, and remove the ones you don’t use.
• Use strong, unique passwords and two-factor authentication for every admin user.
• Keep automatic daily backups stored away from your website’s server.
• Use a security plugin or a firewall service, and only install themes and plugins from trusted sources.

Our guide to keeping your website safe goes through each step, and our WordPress maintenance guide explains how to update without breaking anything.

What we see when a client’s website has been hacked

When a business calls us saying “my website has been hacked”, the first questions we ask are the same each time: when was it last updated, who has logins, and is there a backup from before the problem started? The answers usually point to the cause and the fastest fix. A site with a recent, clean, offsite backup is usually back online far sooner than one without, which is why backups and updates are the core of our website care plans (from $275 + GST a month, minimum 6 months).

Frequently asked questions

Has my website been hacked if Google shows a warning?

Very likely. A “This site may be hacked” note or a red browser warning means Google has found hacked content or malware on your site. Check the Security issues report in Search Console for the details, clean the site, then request a review to remove the warning.

Can I clean up a hacked website myself?

Sometimes. If you have a clean backup and can log in, restoring it and changing every password may be enough. If you don’t know how the attacker got in, or the hack keeps coming back, get a specialist, because a half-cleaned site is often reinfected.

Will a hacked website hurt my Google rankings?

It can. Google may show warnings beside your listing, and spam pages added by hackers can damage how your site appears in search. Cleaning the site quickly and requesting a review in Search Console gives you a good chance of recovering.

My website got hacked. Do I need to tell my customers?

It depends on what was accessed. If personal information may have been exposed and your business is covered by the Privacy Act, the Notifiable Data Breaches scheme may require you to tell the people affected and the OAIC. Read the OAIC’s guidance or get advice; telling customers early and plainly usually protects their trust.

How long does it take to recover a hacked website?

It depends on the damage and on whether you have a clean backup. Restoring a recent backup can be quick; cleaning a site with no backup takes longer. Google’s review after you request it can also take time, so start as soon as you notice the problem.

The short version

If you find your website hacked, act fast but in order: take a copy, take it offline, change passwords, clean or restore, close the hole and ask Google to recheck. Then put updates and backups on a schedule so it doesn’t happen again.

Need help now? Contact our Mildura team or call 1800 842 022.