If you need emergency website hack help in New Zealand, the most important thing you can do right now is take your site offline or into maintenance mode to stop further damage to your visitors and your data. Most hacked websites can be fully recovered, but speed matters — every minute your compromised site stays live, attackers can steal data, infect visitors, or deepen their access. Follow the steps below in order, even if you are not a technical expert.

What Are the Signs Your New Zealand Website Has Been Hacked?

Before you can fix the problem, confirm you are actually dealing with a hack rather than a server error or plugin conflict. Common signs include:

  • Your browser or Google Search shows a "This site may be hacked" or "Deceptive site ahead" warning
  • Visitors report being redirected to unfamiliar or suspicious websites
  • Your web host has suspended your account with a malware notice
  • You notice strange new admin users, files, or content you did not create
  • Google Search Console has sent you a Manual Actions or Security Issues alert
  • Your site is inexplicably slow or sending spam emails
  • Your homepage has been defaced with unfamiliar text or images

If two or more of these apply, treat it as a confirmed hack and move immediately to containment.

Step 1: Contain the Damage Immediately

Put Your Site Into Maintenance Mode or Take It Offline

Leaving a hacked site live harms your visitors and worsens your Google rankings. Use your hosting control panel (cPanel, Plesk, or your host's dashboard) to:

  1. Suspend or password-protect your site at the hosting level — this blocks public access while keeping your files intact for investigation.
  2. If you use WordPress, plugins like Maintenance or Coming Soon Page can put up a holding page, but only do this after you have already changed your passwords (see Step 2), otherwise the attacker still has access.

Notify Your Hosting Provider

New Zealand hosting companies such as Catalyst IT, Vodafone Business, and Spark Business all have support lines. Contact your host's support team and tell them your site has been compromised. Ask them to:

  • Confirm whether malware has been detected on the server
  • Provide recent access logs (error logs and access logs, usually found at /var/log/apache2/ or /var/log/nginx/ on Linux servers, or via cPanel > Logs)
  • Confirm whether other accounts on a shared server have also been affected

Step 2: Secure Your Accounts Before Anything Else

Cleaning your site is pointless if the attacker still has your credentials. Do this before touching any files.

Change All Passwords Immediately

  • Hosting control panel (cPanel, Plesk, etc.)
  • FTP / SFTP accounts — log into your host and delete any FTP accounts you do not recognise
  • Database password — update this in your hosting panel and in your site's configuration file (e.g., wp-config.php for WordPress, .env for Laravel)
  • CMS admin password (WordPress, Joomla, Drupal, etc.)
  • Email accounts associated with the domain
  • Domain registrar account — critical, as attackers sometimes attempt domain hijacking

Use a password manager and generate passwords of at least 16 characters with mixed characters.

Enable Two-Factor Authentication (2FA)

Enable 2FA on every account that supports it — your hosting panel, CMS, domain registrar, and email. This is one of the single most effective steps you can take, as confirmed by CISA (Cybersecurity and Infrastructure Security Agency) and CERT NZ, New Zealand's own national cyber security response team.

Revoke Suspicious Sessions and API Keys

  • In WordPress: go to Users > All Users and delete any admin accounts you do not recognise. You can also force all sessions to expire by updating your secret keys in wp-config.php via the WordPress secret key generator.
  • Check for unauthorised OAuth applications or API tokens connected to your site or hosting account.

Step 3: Identify How the Attacker Got In

You cannot fully secure a site without understanding the entry point. The most common vulnerabilities according to OWASP (Open Web Application Security Project) include:

Check for Outdated Software

  • Unpatched CMS versions (WordPress, Joomla, Drupal)
  • Outdated themes and plugins — even inactive ones
  • Outdated PHP versions (check in cPanel > PHP Selector or ask your host)

Run a CMS version check and compare it to the official changelog to see if known vulnerabilities were present.

Review Server Access Logs

Access logs show every request made to your server. Look for:

  • Unusual POST requests to PHP files in /wp-content/uploads/ (a classic shell upload location)
  • Repeated requests from a single IP address in a short period (brute force)
  • Access to configuration files like wp-config.php or .env

In cPanel, access these under Logs > Raw Access or Errors. On a VPS, use:

bash grep "POST" /var/log/apache2/access.log | tail -100

Check for Web Shells

A web shell is a malicious script left behind by attackers to maintain access. Search for recently modified PHP files:

bash find /home/yourusername/public_html -name "*.php" -newer /home/yourusername/public_html/index.php -ls

Any PHP file modified after your last known-good deployment date is suspicious.

Step 4: Clean Your Website

Restore From a Clean Backup

The fastest and most reliable recovery method is restoring from a known-clean backup taken before the hack occurred. Most New Zealand hosts offer automated backups — check your hosting control panel under Backup or JetBackup.

Important: Before restoring, confirm the backup pre-dates the compromise. If you restore an already-infected backup, you will simply re-introduce the malware.

After restoring, immediately patch whatever vulnerability allowed the hack in the first place, or you will be re-hacked within hours.

If You Have No Clean Backup — Manual Cleaning

If no pre-hack backup is available, you will need to clean files manually or use a scanning tool.

For WordPress Sites

  1. Download a fresh copy of WordPress core from wordpress.org and compare core files to your server files. Do not modify wp-config.php or the /wp-content/ folder.
  2. Use a reputable malware scanner. Wordfence Security (free tier available) and Sucuri SiteCheck (free online scanner at sitecheck.sucuri.net) are widely trusted.
  3. Replace all core WordPress files by uploading the fresh copy via FTP/SFTP, overwriting everything except wp-content/ and wp-config.php.
  4. Delete and reinstall all plugins and themes from their official sources — do not trust files that were on the server.
  5. Check the database for malicious content: look for <script> tags, eval(base64_decode, iframe injections, or unknown admin users in the wp_users table.

For Other Platforms (Joomla, Drupal, Custom PHP)

  • Compare all files against the official release package using a diff tool
  • Scan with Maldet (Linux Malware Detect) if you have SSH access: 
    maldet -a /home/yourusername/public_html/
  • Remove any files not belonging to the official codebase or your own custom development

Clean the Database

Malware is often injected into the database, not just files. Use phpMyAdmin (available in cPanel) to search your database tables for common malicious strings:

  • eval(
  • base64_decode
  • <iframe
  • document.write
  • hacked by

Export your database first as a backup before making any changes.

Step 5: Harden Your Website Against Future Attacks

Cleaning without hardening means you will likely be hacked again. Apply these measures before bringing your site back online.

Update Everything

  • Update your CMS to the latest stable version
  • Update all plugins, themes, and extensions
  • Update PHP to a currently supported version (PHP 8.1 or higher as of 2024 — check php.net/supported-versions)
  • Delete all inactive plugins and themes — they are attack surfaces even when disabled

Implement a Web Application Firewall (WAF)

A WAF filters malicious traffic before it reaches your site. Options suitable for New Zealand-hosted sites include:

  • Cloudflare (free tier available, with a New Zealand-accessible network)
  • Sucuri Firewall (paid, includes malware monitoring)
  • Wordfence (WordPress-specific, free and premium tiers)

Set Correct File Permissions

Incorrect file permissions are a major contributor to hacks. The recommended settings for most Linux-based hosting are:

  • Directories: 755
  • Files: 644
  • wp-config.php: 600 (WordPress)

Set these via SSH:

bash find /home/yourusername/public_html -type d -exec chmod 755 {} ; find /home/yourusername/public_html -type f -exec chmod 644 {} ; chmod 600 /home/yourusername/public_html/wp-config.php

Disable File Editing in the CMS Dashboard

For WordPress, add this line to wp-config.php to prevent attackers from editing theme/plugin files through the dashboard if they gain CMS access:

php define('DISALLOW_FILE_EDIT', true);

Implement HTTP Security Headers

Add these to your .htaccess file (Apache) or Nginx config to reduce the risk of cross-site scripting (XSS) and clickjacking:

Header always set X-Frame-Options "SAMEORIGIN" Header always set X-Content-Type-Options "nosniff" Header always set X-XSS-Protection "1; mode=block" Header always set Referrer-Policy "strict-origin-when-cross-origin"

Step 6: Report the Incident

Report to CERT NZ

CERT NZ (Computer Emergency Response Team New Zealand) is the official government body for cyber incident reporting in New Zealand. Reporting your incident helps them track attack trends and may result in direct assistance.

  • Website: www.cert.govt.nz
  • Phone: 0800 CERTNZ (0800 237 869)
  • Online report form available 24/7

Reporting is free and confidential. CERT NZ publishes quarterly threat reports that benefit all New Zealand businesses.

Report to Google (If Your Site Was Flagged)

If Google has flagged your site with a Safe Browsing warning:

  1. Log into Google Search Console (search.google.com/search-console)
  2. Navigate to Security & Manual Actions > Security Issues
  3. Review all flagged issues and mark them as fixed
  4. Click Request a Review — Google typically responds within 1–3 days for malware reviews

Google's own guidance on this process is documented at Google Search Central (developers.google.com/search/docs/monitor-debug/security).

Notify Affected Users if Personal Data Was Exposed

Under the New Zealand Privacy Act 2020, if the breach involves personal information and poses a real risk of harm, you are legally required to notify the Office of the Privacy Commissioner (OPC) and affected individuals. Notify the OPC at www.privacy.org.nz. Failure to notify when required can result in significant penalties.

Step 7: Monitor and Verify

Re-scan Your Site

After cleaning, run a fresh scan before going live:

  • Sucuri SiteCheck: sitecheck.sucuri.net
  • VirusTotal URL scanner: virustotal.com
  • Google Safe Browsing test: transparencyreport.google.com/safe-browsing/search

Set Up Ongoing Monitoring

  • Enable Google Search Console alerts for security issues
  • Set up uptime monitoring (free tools like UptimeRobot notify you of downtime)
  • Configure your WAF to send email alerts on blocked attacks
  • Schedule weekly automated malware scans via your hosting panel or Wordfence

Verify Your Backups Are Working

After recovery, confirm that your host's automated backup system is active and test a restore to a staging environment. Many site owners discover their backups were not running properly only after a hack — do not let that be you.

Who Can Help: Professional Website Security Services in New Zealand

If the damage is extensive, you lack technical skills, or you are under time pressure, professional help is the fastest path to recovery. In New Zealand, you can find qualified help through:

  • CERT NZ's incident response resources — cert.govt.nz
  • Independent cybersecurity consultants listed on the New Zealand Information Security Forum (NZISF) directory at nzisf.org.nz
  • Web development agencies with security specialisations — look for those with certifications such as OSCP, CEH, or CISSP
  • Managed security service providers (MSSPs) who can take over monitoring and incident response entirely

When engaging a professional, ask specifically whether they will provide a root cause analysis — not just a clean-up. Without knowing how the attacker entered, you remain vulnerable.

Frequently Asked Questions

How long does it take to recover a hacked website in New Zealand?

Recovery time depends on the severity of the hack and whether you have a clean backup. A straightforward restore from backup can take as little as 1–4 hours. Manual cleaning of a severely infected site without a backup can take 1–3 days, including scanning, file replacement, database cleaning, and Google review. Factor in an additional 1–3 business days if you need Google to remove a Safe Browsing warning.

Will my Google rankings recover after a hack?

Yes, in most cases rankings recover fully once you clean your site and Google's Safe Browsing warning is lifted. Google Search Central documentation confirms that once a Security Issues review passes, warnings are removed typically within 72 hours. Rankings may take a few weeks to fully normalise as Google re-crawls your site. The sooner you act, the less lasting damage there is to your SEO.

Do I have to report a website hack to anyone in New Zealand?

You are not legally obligated to report every hack, but you must notify the Office of the Privacy Commissioner and affected individuals if personal data was accessed and there is a real risk of harm — this is a requirement under the Privacy Act 2020. Reporting to CERT NZ is voluntary but strongly encouraged, as it contributes to national threat intelligence that protects other New Zealand businesses.

How did hackers find my small New Zealand website?

Most hacks are not personally targeted — automated bots constantly scan every IP address on the internet looking for known vulnerabilities in outdated software, weak passwords, and misconfigured servers. Your site's size or location is irrelevant. OWASP research consistently shows that outdated software and weak authentication are the leading causes of website compromise worldwide, including in New Zealand.

How can I prevent my website from being hacked again?

The most effective preventive measures are: keeping all software (CMS, plugins, themes, PHP) updated; using strong, unique passwords with 2FA on all accounts; running a Web Application Firewall; taking regular verified offsite backups; and monitoring via Google Search Console and an uptime monitor. CERT NZ publishes a free Critical Controls guide at cert.govt.nz specifically tailored to New Zealand businesses that covers these measures in detail.