A hacked website is one where somebody else has changed your pages, added their own or taken access. Calm, ordered steps matter more than speed, and the first hour is mostly about limiting further damage.
Short answer
Confirm what changed, change every password for the site, host and email, and contact your host or builder for help. Restore a clean copy from a backup, find how the attacker got in, and tell anyone whose details may have been exposed. Nothing here is legal advice.
Signs include pages you did not write, redirects to unfamiliar sites, a browser warning, a host suspension or customers reporting odd messages. Look at the site in a private window on a phone as well as your computer.
Do not delete anything yet. Take screenshots and write down what you see and when. Those notes help your host and help you later. This is general guidance, not legal advice.
Some attacks are quiet. The visible site looks fine while hidden pages promote other products, so a search for your business name followed by a few unrelated words can reveal pages you never made.
Change the password for the site admin, the hosting account, the domain registrar and the email address that receives resets. Use long, different passwords and turn on two-step sign-in wherever offered.
Do this from a device you trust. If the attacker came in through a stolen password, any account sharing it is at risk, so work through every account that used the same one.
Use a password manager to create each new password. A reused or short password is a common way in, so replacing every one is worth the time it takes.
Hosts and builders see logs you cannot. Contact support, describe what you noticed and ask what they can see. Many can isolate the site, scan it and tell you which files changed.
Our page on what hosting does explains what a host is responsible for. Ask directly whether a clean backup exists and how recent it is.
Be specific when you write to support: the date you noticed, the pages affected and anything that changed recently, such as a new plugin, a new user or a payment you did not expect.
Follow the sequence below and tick each item off. Order matters: securing access before restoring prevents the attacker walking straight back in.
Restoring a backup from before the problem usually beats trying to clean files by hand. Then find the cause: an old plugin, a weak password, a shared login or an outdated component.
Our backups and versions page explains why a rollback point matters. Without knowing the cause, the same door stays open and the problem returns.
Update everything that can be updated before you reopen the site. A restored copy with the old weakness still in place can be attacked again.
If a form on your site collected names or contact details, think about who might be affected. Tell them plainly what happened, what you did and what they should watch for.
Rules about breach notice differ by situation and place, and this page cannot say what applies to you. Ask a qualified lawyer if customer data may have been exposed.
Keep a short written record of the incident: what happened, when you found it and what you changed. It helps your provider, your insurer if you have one and you the next time.
Keep software updated, use a password manager, limit who has admin access and remove accounts for people who have left. Our website security basics page covers the routine.
No setup makes a site impossible to attack. The aim is to make yours a harder target and to recover quickly when something goes wrong.
Plan for a bad day before it happens. Know who to call, keep a recent backup somewhere separate and make sure at least two people can sign in to every account.
Write down what you see and change your passwords from a trusted device. Then contact your host or builder. Do not delete files until you have recorded what changed.
If visitors could be harmed, such as by a redirect to a harmful page, a short maintenance notice is sensible. Ask your host how to do this without losing evidence.
Restoring a backup from before the problem is usually safer than hand cleaning. Hand cleaning often misses hidden files that let the attacker return.
If their details may have been exposed, telling them plainly is the decent course. What the law requires depends on your situation, so ask a qualified lawyer. This is not legal advice.
15-day free trial. Card required. Cancel within 15 days of adding your card and you pay nothing.