If you need emergency website hack help in Australia, the most important thing to do right now is stay calm and act systematically — every minute matters, but panicked decisions make recovery harder. Most hacked websites can be fully restored within 24–72 hours when the right steps are followed in the correct order. This guide walks you through exactly what to do, from the moment you discover the breach to getting a hardened, clean site back online.

What Are the Warning Signs Your Website Has Been Hacked?

Before diving into recovery, confirm you are actually dealing with a hack and not a hosting outage or software bug. Common signs include:

  • Google Safe Browsing warnings appearing when visitors try to reach your site (you can check your own site at Google's Safe Browsing test tool)
  • Your web host has suspended your account citing malicious content or spam
  • Unexpected redirects — your homepage redirects visitors to a pharmacy, gambling, or adult site
  • Unfamiliar admin accounts in your CMS dashboard
  • Google Search Console showing security issues alerts or manual actions
  • Defaced pages — your content has been replaced with a hacker's message
  • Sudden traffic spikes or drops with no clear cause
  • Your site appearing in search results for unrelated keywords (a classic sign of SEO spam injection)

If two or more of these apply, proceed immediately to the steps below.

Step 1: Don't Panic — But Act Immediately

Time is your biggest enemy after a hack. The longer malware sits on your server, the more damage it does: it can steal customer data, spread to visitors' devices, send spam, and cause your domain to be blacklisted. Equally, acting rashly — such as deleting everything without a backup — can destroy the forensic evidence you need for recovery and any legal obligations.

Notify Your Web Host Right Now

Australian hosting providers have security teams who deal with compromised sites daily. Call or live-chat your host immediately and tell them your site appears to have been hacked. Many Australian hosts — including those operating under Australian Privacy Act obligations — have incident response procedures and can temporarily isolate your account, provide server-level logs, and assist with malware scanning. Do not just submit a ticket; call if you can.

Report the Incident If Customer Data May Be Involved

Under the Australian Privacy Act 1988 and the Notifiable Data Breaches (NDB) scheme administered by the Office of the Australian Information Commissioner (OAIC), you may have a legal obligation to report a data breach if it is likely to result in serious harm to individuals whose data you hold. Visit oaic.gov.au immediately to assess your obligations. Failure to notify when required can result in significant penalties.

You should also report cybercrime to the Australian Cyber Security Centre (ACSC) at cyber.gov.au and to the Australian Federal Police via ReportCyber at cyber.gov.au/report. Reporting is free, helps national threat intelligence, and creates an official record.

Step 2: Take Your Site Offline and Preserve Evidence

Put Your Site Into Maintenance Mode or Take It Down

You have two goals: stop visitors being harmed by malicious code, and stop the attacker from continuing to use your server. Ask your host to take the site offline or switch it to a maintenance page. If you have cPanel or Plesk access, you can temporarily password-protect the entire directory while you work.

Preserve Everything Before You Change Anything

Before cleaning, document the current state:

  1. Take screenshots of defaced pages, strange admin users, and any error messages.
  2. Download your full server access logs (usually found at /var/log/apache2/access.log, /var/log/nginx/access.log, or via your hosting control panel). These logs show you how the attacker got in.
  3. Export your database in its current (infected) state, clearly labelled, and store it separately. You may need it for forensic or legal purposes.
  4. Note the exact date and time you discovered the hack and the date of any last known clean backup.

Step 3: Change Every Password and Revoke Unauthorised Access

Do this from a clean device — not one you normally use — on a different network (use your mobile data connection, not the same Wi-Fi your compromised computer is on).

Change the following immediately:

  • CMS admin passwords (WordPress, Joomla, Drupal, Magento, etc.)
  • Hosting control panel password (cPanel, Plesk, Kinsta, etc.)
  • FTP/SFTP credentials
  • Database passwords (update wp-config.php or your CMS equivalent after changing the database password)
  • SSH keys — revoke any you do not recognise
  • Email accounts associated with the domain
  • Domain registrar account password and enable two-factor authentication (2FA)
  • Any third-party service API keys your site uses (payment gateways, email marketing tools, etc.)

Remove any administrator or FTP user accounts you did not create. In WordPress, go to Users → All Users and delete unrecognised accounts. In cPanel, go to FTP Accounts and remove unknown entries.

Step 4: Restore From a Clean Backup (If You Have One)

If you have a verified clean backup from before the hack, this is almost always the fastest path to recovery.

How to Verify Your Backup Is Actually Clean

Do not simply restore the most recent backup — it may already contain the malware if the attacker had been lurking for weeks. Check the timeline:

  1. Compare the backup date against the earliest suspicious activity you can find in your server logs.
  2. Scan the backup files with a malware scanner before restoring (see Step 5 for scanner options).
  3. If the backup is clean, restore it to a staging environment first and test it thoroughly.

Restoring Your Site

Your host's control panel typically offers one-click restore from backup. If restoring manually:

  1. Extract the backup archive to a local folder
  2. Upload clean files via SFTP (not FTP — FTP sends credentials in plain text)
  3. Import the clean database via phpMyAdmin or mysql command line
  4. Update your database connection string in your CMS config file
  5. Flush your CMS cache and any CDN cache (e.g., Cloudflare: Caching → Purge Everything)

Step 5: Scan and Clean the Infection (If No Clean Backup Exists)

If you do not have a clean backup, you will need to manually identify and remove malicious code.

Use a Reputable Malware Scanner

Several tools are trusted by security professionals:

  • Wordfence (WordPress plugin — free tier includes malware scan)
  • Sucuri SiteCheck (free online scanner at sitecheck.sucuri.net — scans the public-facing output)
  • MalCare (WordPress — good at detecting obfuscated malware)
  • ImunifyAV (often available free through cPanel/WHM — ask your host)
  • OWASP recommends manual code review in addition to automated scanners, because sophisticated malware is designed to evade detection

Run at least two different scanners, as no single tool catches everything.

Where Hackers Typically Hide Malicious Code

In WordPress (the most commonly targeted CMS in Australia and globally):

  • wp-content/themes/[your-theme]/functions.php — look for unfamiliar eval(), base64_decode(), or gzinflate() function calls
  • wp-content/uploads/ — PHP files should not exist here; delete any you find
  • wp-includes/ — compare file checksums against the official WordPress release (downloadable from wordpress.org)
  • .htaccess — look for redirect rules you did not write
  • wp-config.php — should not contain obfuscated strings

For non-WordPress sites, the same logic applies: compare every file against your last known clean version or the official CMS release package. Use a diff tool or run:

bash diff -rq /path/to/clean/files /path/to/live/files

This will list every file that has changed between a known-clean reference copy and your live site.

Cleaning PHP Malware Manually

When you find infected files:

  1. Do not simply delete the file if it is a legitimate CMS file — replace it with a clean copy from the official source.
  2. For theme/plugin files, download a fresh copy of the theme or plugin from the official repository and replace the infected version.
  3. For database-injected spam (common in WordPress SEO injection attacks), use phpMyAdmin to search your wp_posts and wp_options tables for suspicious URLs or <script> tags. The OWASP Testing Guide provides guidance on identifying SQL-injected content.
  4. Remove any cron jobs the attacker may have added. In cPanel go to Cron Jobs; via SSH run crontab -l to list scheduled tasks.

Step 6: Find and Fix the Entry Point

Cleaning malware without fixing how the attacker got in means you will be reinfected, often within hours. Review your server logs (from Step 2) to identify the attack vector.

Common Entry Points

  • Outdated plugins, themes, or CMS core — the single biggest cause of WordPress hacks globally. Check your CMS version and all plugins/themes against known vulnerabilities at the National Vulnerability Database (NVD) at nvd.nist.gov.
  • Weak or reused passwords — brute-force attacks are extremely common.
  • Nulled (pirated) themes and plugins — these almost always contain backdoors.
  • Compromised FTP credentials — often harvested by malware on your local computer.
  • Vulnerable contact forms or file upload fields — classic vectors described in the OWASP Top 10, particularly Injection and Broken Access Control.
  • Exposed xmlrpc.php (WordPress) — commonly exploited for brute-force and DDoS amplification.

Once identified, patch or disable the vulnerability before bringing the site back online.

Step 7: Harden Your Site to Prevent Reinfection

Recovery is not complete until you have actively hardened your site. The Australian Cyber Security Centre (ACSC) publishes the Essential Eight mitigation strategies, several of which apply directly to website security.

Essential Hardening Steps

Update everything:

  • CMS core, all plugins, all themes — update to the latest stable versions immediately
  • Delete any plugins or themes you are not actively using
  • Never use nulled software

Enable a Web Application Firewall (WAF):

  • Cloudflare (free tier available) sits in front of your site and blocks common attack patterns before they reach your server
  • Sucuri WAF and Wordfence (WordPress) are also widely used

Implement strong authentication:

  • Enforce 2FA on all CMS admin accounts
  • Use a password manager to generate unique, long passwords
  • Limit login attempts (Wordfence, Login Lockdown, or similar plugins)
  • Change the default admin login URL if using WordPress (e.g., move /wp-admin with a plugin like WPS Hide Login)

Set correct file permissions:

  • Directories: 755
  • Files: 644
  • wp-config.php: 440 or 400
  • Never set files or directories to 777

Disable file editing in WordPress CMS: Add to wp-config.php: php define('DISALLOW_FILE_EDIT', true); define('DISALLOW_FILE_MODS', true);

Set up security headers: Ask your host or configure in .htaccess:

Header always set X-Content-Type-Options "nosniff" Header always set X-Frame-Options "SAMEORIGIN" Header always set X-XSS-Protection "1; mode=block" Header always set Referrer-Policy "strict-origin-when-cross-origin"

Implement regular, offsite, automated backups:

  • Store backups in a separate location from your server (e.g., AWS S3, Backblaze B2, or a local drive)
  • Test restores quarterly — a backup you have never tested is a backup you cannot trust
  • Keep at least 30 days of rolling backups

Monitor your site going forward:

  • Google Search Console — free, alerts you to security issues
  • Uptime monitoring (UptimeRobot free tier, or Pingdom) — alerts you to downtime
  • Sucuri SiteCheck — run weekly
  • Enable ACSC's free cyber threat intelligence sharing for Australian businesses

Step 8: Request Removal From Blacklists and Restore Search Rankings

Once your site is clean and hardened, you need to tell the world.

Google Search Console

  1. Log in to Google Search Console
  2. Go to Security & Manual Actions → Security Issues
  3. Review flagged issues and confirm they are resolved
  4. Click Request Review

Google typically reviews requests within 1–3 days for security issues. If you received a manual action (spam penalty), the review is handled by Google's webspam team and may take up to several weeks, as outlined on the Google Search Central documentation.

Other Blacklist Removal

Check your domain against other blacklists and request removal:

  • McAfee SiteAdvisor — submit via trustedsource.org
  • Norton Safe Web — submit via safeweb.norton.com
  • Spamhaus (if your server IP was used for spam) — follow the removal process at spamhaus.org
  • SURBL, URIBL — removal requests via their respective websites

Use MXToolbox Blacklist Check to check your domain and IP against dozens of lists at once.

When to Call a Professional Website Security Expert

If you have followed these steps and the malware keeps returning, or if the attack is complex (e.g., server-level rootkit, compromised hosting environment, or data has clearly been exfiltrated), it is time to engage a professional.

In Australia, look for security professionals who hold certifications such as:

  • CISSP (Certified Information Systems Security Professional)
  • CEH (Certified Ethical Hacker)
  • OSCP (Offensive Security Certified Professional)
  • Membership of AISA (Australian Information Security Association)

The ACSC also provides a Find a Cyber Security Professional service for Australian businesses.

Expect to pay between $150–$500+ AUD per hour for qualified incident response work, or fixed-price site cleanup packages from reputable security firms ranging from approximately $300–$2,000+ AUD depending on complexity.

Frequently Asked Questions

How long does it take to recover a hacked website in Australia?

With a clean backup and straightforward infection, most sites can be back online within 4–12 hours. Without a backup, manual cleanup and hardening typically takes 1–3 days. Complex attacks involving database injection, multiple backdoors, or server-level compromise can take longer and may require professional help.

Will my Australian business face legal consequences if customer data was stolen in the hack?

Potentially, yes. Under the Notifiable Data Breaches scheme, organisations covered by the Australian Privacy Act must notify both the OAIC and affected individuals if a data breach is likely to cause serious harm. Failure to notify when required can result in civil penalties up to $50 million AUD for serious or repeated breaches under 2022 amendments to the Privacy Act. Contact a privacy lawyer and the OAIC as soon as possible if customer data may have been accessed.

Should I pay a ransom if hackers are threatening to release my data?

The ACSC strongly advises against paying ransoms. Payment does not guarantee data will not be published, marks you as a target willing to pay, and may fund criminal organisations. Report the extortion to the Australian Federal Police via ReportCyber and consult the ACSC for guidance before making any decisions.

Why does my hacked website keep getting reinfected after I clean it?

Re