My website was hacked: what to do first

1. Has my website been hacked?

"Hacked" means someone got into your website without your permission. Often you can't see it: Google says hacks are often invisible to visitors, yet still harm anyone who opens the page. These are the usual signs:

Google says so

"This site may be hacked" under your site in search results means Google thinks someone changed your pages or added spam pages. A red page saying "Deceptive site ahead" or "Dangerous site" is a related warning: see "Deceptive site ahead" on my website.

Pages you didn't make

Strange pages in Google results for your site, or your pages sending people somewhere else. Open your site on your phone in a private tab: some hacks only show to visitors, and Google suggests checking from a mobile browser.

Someone new in the admin

An admin or editor you don't know, or changes you didn't make.

Spam from your domain

Customers get odd emails from your address, or you get bounces for emails you never sent. That can be a fake sender rather than a hack: here's how to tell.

Your host shut it down

A suspended account, or an email from your host saying your site is sending spam or attacking others.

Visitors complain

People say their antivirus or security software blocks your site.

A scary email telling you your site was hacked isn't proof; scammers send them. Check for yourself with Google's Safe Browsing site status and Search Console (see Google's warning). A clean site status doesn't prove you're safe: Google says its checks can miss sites hacked to show spam.

2. What to do first

1. Stay calm, and write down what you see. Note what looks wrong, when you first saw it (with your time zone), and anything you changed recently, like a new plugin or theme. How to take a screenshot.
2. Don't delete anything yet. The extra pages and files are the clues your web person needs to find how they got in. WordPress.org's advice is to take one more copy of the site before cleaning, even an infected one. How to back up your website.
3. Call your host. Google's advice is to contact your hosting provider first, since they can often do the technical work, and WordPress.org points out a hack on shared hosting can touch more than your site. Not sure who it is? Who hosts this website? tells you.
4. Change the passwords. Start with your email, then the website admin, the hosting account and the domain account, on a device you trust. WordPress.org advises long, unique passwords, changing every way in and every user, and turning on two-step login. Remove any admin users you don't know. Locked out? Can't log in to my website.
5. Tell your web person. Send the message below. They should check the whole site, not only the page you noticed.
6. Think about going offline while it's cleaned. Google's Search Console Help says a hacked site has to be shut down while it's cleaned. Take your website offline has the options; ask your web person or host how to do it, because Google calls disabling a whole site an extreme step that can hurt your search results, for a few days at most.
7. Clean it, then change the passwords again. Your web person removes what was added, restores a clean backup if there is one, updates everything and works out how they got in. WordPress.org says to change passwords again once the site is clean.

3. Ask Google to remove the warning

Google tells site owners about hacks in Search Console, its free tool for site owners. If your site isn't set up there, your web person can add and verify it.

1. Open Security issues. In Search Console, the Security issues report lists what Google found: hacked content, malware or unwanted software, or social engineering (tricking visitors). It shows sample pages.
2. Finish the cleanup first. Google says to fix every listed issue on all the affected pages, not just some.
3. Choose Request review. Say what the problem was, what you did to fix it, and what happened after. If you recently bought or took over the site, say that too (see taking over a website).
4. Wait, and don't send it again. Reviews usually take several days to several weeks. Google emails you when it gets the request and when the review is done. Sending a second request while one is waiting can slow later reviews.

Got a "Compromised sites" notice in Google Ads? It's the same cleanup. Google's ad policy says to remove the code that points to the domains it names, and suggests running the Security issues report and updating your CMS, themes and plugins. Then resubmit the ads and allow up to 72 hours for Google to check the page again.

4. Squarespace, Wix, Shopify or WordPress

On a builder, the builder runs the website's software, so the way in is usually your account. On WordPress, it can be your account, or an old plugin, theme or WordPress itself.

Squarespace

Open Account settings, then Activity: it shows 90 days of activity, including logins, domain, website and permission changes. If you see something you don't recognize, change your password, set up two-factor authentication, and remove any contributor you don't recognize.

Wix

Wix says to change your password straight away, turn on 2-step verification in Account Settings, and contact Wix Customer Care.

Shopify

Shopify says to contact Shopify Support immediately. Then change your email password and your Shopify password, turn on two-step authentication, check the login activity, and look through staff permissions, the activity log, installed apps and your orders. Check Shopify Balance, Credit, Capital and Payments for activity you don't recognize.

WordPress

Call your host and your web person. WordPress.org's page for a hacked site adds: reset every user's password, update WordPress, themes and plugins once it's clean, and ask in the WordPress.org support forums if you can't pay for help.

On a builder you can't clean the server yourself: support is the route. If your account was taken over and you can't log in, use the builder's own account recovery page.

5. When to pay a professional

• Google keeps the warning after a review, or the strange pages keep coming back. Something is still in the site, or the way in is still open.
• You take payments or keep customers' details. Someone should find out what was reached.
• You can't log in to your own admin, or your host won't help.
• Nobody looks after the site. A cleanup is a good time to hire a web person who will also keep it updated.

Ask whoever helps to tell you in plain words how they got in. WordPress.org says that is hard for owners to work out without technical knowledge, and if the way in isn't closed, the hack can come back.

6. What PageKiwi can and can't see

PageKiwi doesn't scan for viruses or read Google's warning lists, so no PageKiwi check can tell you whether you were hacked. Use Google's site status and Search Console for that. Site health shows whether your site is loading and its padlock works, and afterward a Full Check looks for broken links and pages.