Your website was hacked. Now what?
Finding strange pages, spam links or a warning from your browser is stressful. Stay calm and work through these steps.
1. Don't delete everything
Deleting files can destroy the evidence needed to find how the attacker got in. Take the site offline or put it in maintenance mode instead.
2. Change your passwords
Change passwords for your website admin, hosting account, database and email, and turn on two-factor authentication.
3. Find and remove the infection
Hacks usually leave backdoors so attackers can return. A proper cleanup checks every file and database table, not just the visible damage.
4. Fix the way in
Most hacks come through outdated software, weak passwords or vulnerable plugins. Update everything and remove what you don't use.
5. Clear warnings and monitor
Once clean, ask search engines to review the site so warnings are removed, and keep monitoring for any return.