If you need emergency website hack help in Singapore, the most important thing you can do right now is stay calm and act methodically — every minute your site stays compromised puts your visitors, data, and search rankings at greater risk. Most hacked websites can be fully recovered within 24–72 hours if you follow the right steps in the right order. This guide gives you exactly that, written for website owners who are not security experts.

How Do You Know Your Website Has Been Hacked?

Before you start recovery, confirm the compromise is real. Common signs include:

  • Your browser or Google Chrome displays a red "Deceptive site ahead" warning
  • Google Search Central's Search Console shows a Security Issues alert under your property
  • Visitors are being redirected to unfamiliar or spammy websites
  • Your hosting provider has suspended your account citing malware or abuse
  • You see unfamiliar admin accounts, strange files, or injected links in your page source
  • Your site is defaced — replaced with a hacker's message or image
  • Unusual spikes in server resource usage or outbound email

If two or more of these apply, treat it as confirmed and move immediately to containment.

Step 1: Don't Panic — Start an Incident Log

Open a plain text file or notebook right now and record:

  • The date and time you discovered the hack
  • What you saw (screenshot everything)
  • Any recent changes made to the site (plugin updates, new users added, file edits)
  • Your hosting provider name and support contact

This log will be essential if you need to report the incident to the Cyber Security Agency of Singapore (CSA) or engage a professional recovery service.

Step 2: Put Your Site Into Maintenance Mode Immediately

Taking your site offline prevents further harm to your visitors and stops search engines from crawling and indexing malicious content deeper into your pages.

For WordPress sites:

  1. Log in to your hosting control panel (cPanel, Plesk, or similar)
  2. Use a maintenance mode plugin such as WP Maintenance Mode if you still have admin access, OR
  3. Create a temporary maintenance.php file in your root directory and use an .htaccess redirect — your host's support team can help with this

For non-WordPress sites:

  • Contact your hosting provider's emergency support line and ask them to temporarily suspend the public-facing site while keeping your admin/FTP access live

Do not delete any files yet — you need them for diagnosis.

Step 3: Change Every Password — Right Now

From a clean, trusted device (not the computer you normally use to manage the site):

  1. Hosting control panel password (cPanel, SiteGround, Kinsta, etc.)
  2. FTP/SFTP credentials — all of them, not just the main one
  3. Database password (update wp-config.php or your equivalent config file to match)
  4. CMS admin passwords — WordPress, Joomla, Magento, etc.
  5. Domain registrar account password
  6. Email accounts associated with the domain
  7. Any third-party services connected to the site (Cloudflare, Google Analytics, payment gateways)

Enable two-factor authentication (2FA) on every account that supports it. The CSA of Singapore specifically recommends 2FA as a frontline defence in its SG Cyber Safe guidelines.

Step 4: Scan Your Site for Malware

Using Your Hosting Provider's Built-in Scanner

Many Singapore-based and international hosting providers (including those with local data centres) include malware scanning tools in their control panels. Log in and look for:

  • Imunify360 (common on cPanel hosts)
  • SiteLock (offered as an add-on by many hosts)
  • Sucuri SiteCheck — free online scanner at sitecheck.sucuri.net — paste your URL and run it immediately

For WordPress Sites

Install and run Wordfence Security or MalCare from the WordPress plugin repository. These tools will:

  • Scan core files against known-good WordPress checksums
  • Identify modified, injected, or unknown files
  • Flag suspicious user accounts and backdoors

For All Sites — Manual File Check via FTP/SFTP

Connect via SFTP using FileZilla or your host's file manager and sort all files by Last Modified date. Any files modified around the time of the hack that you did not touch yourself are suspect.

Key locations to check on a Linux server:

  • /public_html/ — your web root
  • /public_html/wp-content/uploads/ — often used to plant PHP shells
  • /tmp/ — frequently used by attackers for staging malicious scripts
  • .htaccess files in the root and subdirectories

Look for obfuscated PHP code — strings beginning with eval(base64_decode( are almost always malicious.

Step 5: Remove Malicious Code and Files

If You Have a Clean Backup

This is the fastest and most reliable recovery method.

  1. Verify your backup predates the hack (check file timestamps and run a quick scan on the backup files)
  2. Delete the compromised installation completely from your server
  3. Restore the clean backup via your host's backup restore tool or manually via SFTP
  4. Immediately apply all available updates before bringing the site back online

Where to find your backups:

  • Hosting control panel → Backup section (JetBackup, cPanel Backup Wizard)
  • Your own off-site backup solution (e.g., UpdraftPlus for WordPress, stored to Google Drive or Dropbox)

If You Do Not Have a Clean Backup

You will need to clean the site manually or engage a professional:

  1. Download a fresh copy of your CMS (WordPress, Joomla, etc.) from the official source
  2. Replace all core files by uploading the fresh copy over the existing installation — do not overwrite wp-config.php or your wp-content folder yet
  3. Manually review every file in wp-content/themes/ and wp-content/plugins/ for injected code
  4. Remove any plugins or themes you do not recognise or no longer use
  5. Check your database for injected content — look in the wp_options table for suspicious URLs or <script> tags injected into siteurl or widget settings

OWASP (the Open Web Application Security Project) provides detailed guidance on web application security controls that can help you understand what the attacker likely exploited.

Step 6: Close the Security Hole the Attacker Used

Cleaning the site is pointless if the vulnerability remains open. Common entry points include:

Outdated Software

Update WordPress core, all plugins, and all themes to their latest versions immediately. According to Sucuri's annual hacked website research, outdated plugins and themes account for the majority of WordPress compromises.

Weak or Reused Passwords

Already addressed in Step 3 — but also audit all user accounts in your CMS and delete any you did not create.

Nulled (Pirated) Themes and Plugins

These almost always contain backdoors. Remove them entirely and replace with legitimate, purchased, or free versions from official repositories.

File Upload Vulnerabilities

If your site allows user uploads, ensure uploaded files cannot be executed as PHP. Your host's support team can add an .htaccess rule to your uploads directory:

<FilesMatch ".(php|php3|php4|php5|phtml)$"> deny from all </FilesMatch>

Compromised Hosting Credentials

If your FTP password was weak or phished, the attacker accessed your files directly. New strong passwords (Step 3) and 2FA address this.

Step 7: Harden Your Site Before Going Back Online

Do not restore public access until you have completed these hardening steps:

  • Install a Web Application Firewall (WAF): Cloudflare's free plan offers basic WAF protection; Sucuri's WAF provides more comprehensive coverage and is widely used by Singapore businesses
  • Disable XML-RPC (WordPress): If you do not use it, disable it — it is a common attack vector
  • Limit login attempts: Use a plugin like Limit Login Attempts Reloaded to block brute-force attacks
  • Set correct file permissions: WordPress files should be 644, directories 755, and wp-config.php should be 400 or 440
  • Enable HTTPS: If you are not already on SSL/TLS, install a free Let's Encrypt certificate through your host
  • Set up automatic backups: Daily backups stored off-server are non-negotiable going forward

CISA (the U.S. Cybersecurity and Infrastructure Security Agency) and the CSA of Singapore both publish free hardening checklists that align with these recommendations.

Step 8: Request a Google Review to Remove the Warning

If Google flagged your site with a Safe Browsing warning, it will not disappear automatically once you clean the site — you must request a manual review.

  1. Log in to Google Search Console (previously Webmaster Tools) at search.google.com/search-console
  2. Navigate to Security Issues in the left menu
  3. Tick the box confirming you have fixed all issues
  4. Click Request Review

Google typically processes these requests within 1–3 days for straightforward malware cases. Your site's warning will be lifted once Google's systems verify it is clean. If Search Console is not already set up for your site, verify ownership now — this is also where you will see if Google has detected any remaining issues.

Step 9: Report the Incident in Singapore

You are not obligated to suffer in silence. Singapore has clear channels for reporting cybersecurity incidents:

  • Cyber Security Agency of Singapore (CSA): Report incidents at www.csa.gov.sg/singcert — SingCERT (Singapore Computer Emergency Response Team) provides free technical advisories to businesses
  • Singapore Police Force (SPF): If data was stolen or financial fraud is suspected, file a police report at www.police.gov.sg or at your nearest Neighbourhood Police Centre
  • Personal Data Protection Commission (PDPC): If personal data of Singapore residents was exposed, you may have a mandatory breach notification obligation under the Personal Data Protection Act (PDPA). Report at www.pdpc.gov.sg

Do not skip the PDPA step — fines for failing to notify the PDPC of a data breach within the mandatory 3-day window (for significant breaches) can be substantial.

Step 10: When to Call a Professional

If at any point the steps above feel beyond your technical capability, or if:

  • The hack keeps recurring after cleanup
  • You suspect a targeted attack rather than opportunistic malware
  • Customer payment data or personal data was accessed
  • Your site is large, high-traffic, or business-critical

…then engage a professional incident response service. Look for providers with:

  • Demonstrated experience with WordPress, Magento, or your specific CMS
  • A clear, written scope of work and fixed-price or capped-cost recovery package
  • References from Singapore or regional clients
  • Compliance knowledge around PDPA if data exposure is a concern

Many reputable providers can begin remote emergency work within hours. Ask specifically about post-recovery monitoring, not just the one-time cleanup.

Frequently Asked Questions

How long does emergency website hack recovery take in Singapore?

For most small-to-medium websites, a full recovery — including cleaning, hardening, and getting Google's Safe Browsing warning removed — takes between 24 and 72 hours if you start immediately and have a recent clean backup. Without a backup, manual cleaning can take longer. Engaging a professional service typically speeds this up significantly.

Do I need to notify anyone under Singapore law if my website was hacked?

Possibly yes. Under the Personal Data Protection Act (PDPA), if the breach involves personal data of individuals and is likely to cause significant harm, you must notify the PDPC and affected individuals within 3 days of assessing it as a notifiable breach. You should also consider reporting to SingCERT via the CSA's website. Consult a legal adviser if you are unsure whether notification is required.

My hosting provider suspended my account due to malware — what do I do?

Contact your host's support team immediately. Most Singapore and international hosting providers have a dedicated abuse or security team who will tell you exactly what was found and what you need to do to restore service. Request a copy of their malware report, clean the files they identified, then ask them to review your account again. Do not simply ask them to reactivate without cleaning — it will happen again.

Can a hacked website hurt my Google search rankings?

Yes, significantly. Google Safe Browsing will flag your site and display warnings to visitors, driving away traffic. Google may also deindex pages containing spammy content or penalise your site in rankings. The faster you clean the site and submit a review request through Google Search Console, the faster you can recover your ranking position.

How can I prevent my website from being hacked again?

The most effective prevention measures are: keeping all software (CMS, plugins, themes) updated; using strong, unique passwords with 2FA on all accounts; installing a Web Application Firewall; running daily off-site backups; and conducting periodic security scans. The CSA of Singapore's SG Cyber Safe programme offers free resources and self-assessment tools specifically designed for local businesses of all sizes.