Hacked website recovery help in Australia is available through a combination of your own immediate actions, your hosting provider's support team, and specialist cybersecurity professionals. Most Australian website owners can begin containment within minutes by following a clear, prioritised checklist. Acting fast significantly reduces damage to your search rankings, customer trust, and business revenue.

How Do You Know Your Website Has Been Hacked?

Before you can recover, you need to confirm the compromise. Signs that your Australian website has been hacked include:

Visitors report redirects to spam, gambling, or pharmaceutical sites
Google Search Central (formerly Google Webmaster Tools) has sent you a manual action notice or security alert via Google Search Console
Your hosting provider has suspended your account and cited malware or abuse
Unexpected admin accounts appear in your CMS (e.g., WordPress, Joomla, or Drupal)
Your homepage has been defaced with foreign text or political messages
Unusual spikes in traffic or bandwidth, visible in your hosting control panel
Antivirus warnings appear when visitors try to load your site
Google's Safe Browsing checker at https://transparencyreport.google.com/safe-browsing/search flags your domain

If you see any of these signs, treat your site as compromised and move immediately to containment.

Step 1 — Contain the Damage Immediately

Put Your Site Into Maintenance Mode or Take It Offline

The first priority is stopping your hacked site from harming visitors and spreading malware. If your CMS allows it, enable maintenance mode. If not, contact your host and ask them to temporarily suspend public access. Many Australian hosting providers — including those operating under Australian Privacy Act obligations — will assist you urgently in a confirmed hack scenario.

Change All Passwords Right Now

Change passwords for:

Your hosting control panel (cPanel, Plesk, or similar)
Your CMS admin account (e.g., /wp-admin for WordPress)
Your FTP/SFTP accounts
Your database (MySQL/MariaDB) users
Your domain registrar account
Any email accounts associated with the domain

Use a password manager to generate strong, unique passwords of at least 16 characters. Enable multi-factor authentication (MFA) on every account that supports it.

Revoke Unknown Sessions and API Keys

In WordPress, you can force all users to log out by adding the following line to wp-config.php, then removing it once all passwords are changed:

php define('AUTH_KEY', 'new-random-string-here');

Regenerating the secret keys in wp-config.php via the WordPress secret key generator immediately invalidates all active sessions.

Step 2 — Report the Incident

Report to the Australian Cyber Security Centre (ACSC)

The Australian Cyber Security Centre (ACSC), operated by the Australian Signals Directorate, is Australia's national authority for cybersecurity. You should report the incident at ReportCyber: https://www.cyber.gov.au/report-and-recover/report

Reporting helps the ACSC track attack trends affecting Australian businesses and can connect you with recovery guidance. For small businesses, the ACSC's Small Business Cyber Security Guide is a free resource worth bookmarking.

Notify Your Hosting Provider

Contact your host's support team immediately. Provide:

Your domain name
The approximate time you noticed the issue
Any suspicious files or usernames you have already identified

Reputable Australian hosting providers will run server-side malware scans and may isolate your account to prevent cross-contamination with other hosted sites.

Consider Your Privacy Act Obligations

If your website collects personal information (names, emails, payment data) and the hack exposed that data, you may have a mandatory data breach notification obligation under the Privacy Act 1988 (Cth) and the Notifiable Data Breaches (NDB) scheme, administered by the Office of the Australian Information Commissioner (OAIC). You can assess your obligations and notify at https://www.oaic.gov.au/privacy/notifiable-data-breaches.

Penalties for failing to notify can be significant, so seek legal advice if you are unsure.

Step 3 — Identify How You Were Hacked

Understanding the attack vector is essential — without it, you risk being re-hacked within hours of cleaning your site.

Check Your Server and Access Logs

Raw access logs and error logs are your most important forensic evidence. In cPanel, logs are typically located at:

/home/yourusername/logs/

Or via cPanel → Metrics → Raw Access. Look for:

POST requests to unusual file paths
Requests to PHP files inside /uploads/ or /tmp/ directories (these should not be executable)
Repeated login attempts (brute-force indicators)
Access from unfamiliar IP addresses at unusual hours

Common Attack Vectors on Australian Websites

According to the ACSC's Annual Cyber Threat Report, the most common vectors affecting Australian small business websites include:

Outdated CMS software (especially older WordPress, Joomla, and Magento versions)
Vulnerable plugins or themes — OWASP's Top 10 consistently lists known vulnerable components as a critical risk
Weak or reused passwords — particularly for wp-admin or cPanel
Compromised FTP credentials obtained via malware on your local computer
Shared hosting cross-contamination — another site on your server was hacked first
SQL injection through unpatched contact forms or e-commerce plugins
Stolen session cookies via Cross-Site Scripting (XSS)

Identifying which vector applies to your situation shapes your entire cleanup strategy.

Step 4 — Clean the Malware

Option A: Use a Trusted Malware Scanner

Before manually editing files, run an automated scanner:

Wordfence (WordPress plugin) — free tier includes a full file scan comparing your files against the official WordPress repository checksums
Sucuri SiteCheck — free remote scanner at https://sitecheck.sucuri.net (scans what is publicly visible)
MalCare — detects obfuscated malware that signature-based scanners miss
OWASP's guidance recommends combining automated scanning with manual review for thorough remediation

Note that remote scanners only see what an external visitor sees. Server-side scanners (like Wordfence or your host's scanner) find hidden backdoors in files.

Option B: Restore From a Clean Backup

If you have a verified pre-hack backup, this is often the fastest path to a clean site. Before restoring:

Confirm the backup pre-dates the intrusion (check your logs for when suspicious activity began)
Restore to a staging environment first and scan it before going live
Do not skip patching after restoring — a clean backup on unpatched software will be re-hacked

Your host's backup system (e.g., JetBackup in cPanel) or a plugin like UpdraftPlus may have recent restore points.

Option C: Manual File Cleanup

For those comfortable with server access, manual cleanup involves:

1. Download your current files via SFTP (use SFTP, not FTP — the connection is encrypted) and compare against official CMS source files.

2. For WordPress, replace core files by downloading a fresh copy from https://wordpress.org/download/ and overwriting everything except:

wp-config.php
wp-content/ (themes, plugins, uploads)
.htaccess (review this file carefully — hackers often inject redirect rules here)

3. Check .htaccess for injected redirect rules. A clean default WordPress .htaccess looks like:

apache

BEGIN WordPress

RewriteEngine On RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] # END WordPress

Anything else between or around those markers should be scrutinised.

4. Search for malicious code patterns via SSH (if your host provides SSH access):

bash grep -rl "base64_decode" /home/yourusername/public_html/ grep -rl "eval(" /home/yourusername/public_html/ grep -rl "gzinflate" /home/yourusername/public_html/

These functions are legitimate in some contexts but are heavily used in PHP malware obfuscation. Review every file that appears in these results.

5. Check the database for injected content. In WordPress, look for <script> tags or spam URLs in the wp_options, wp_posts, and wp_users tables using phpMyAdmin or a direct MySQL query:

sql SELECT * FROM wp_options WHERE option_value LIKE '%<script%'; SELECT * FROM wp_users WHERE user_registered > '2024-01-01';

Adjust the date to match the likely intrusion window.

6. Remove unknown admin accounts found in wp_users that you did not create.

Scan Your Local Computer

If FTP credentials were stolen, the source may be malware on your own PC or Mac. Run a full scan with reputable security software before reconnecting to your server. CISA (the US Cybersecurity and Infrastructure Security Agency, whose guidance is widely followed in Australia) recommends using multiple scanning tools as no single product catches everything.

Step 5 — Harden Your Website After Cleanup

Cleaning up without hardening guarantees re-infection. Apply these measures before bringing your site back online.

Update Everything

CMS core — update to the latest stable release
All plugins and themes — delete any you are not actively using; inactive plugins are still a risk
PHP version — ask your host to move you to a currently supported PHP version (PHP 8.1 or later as of 2024)

Implement a Web Application Firewall (WAF)

A WAF filters malicious traffic before it reaches your site. Options commonly used in Australia include:

Cloudflare (free tier available) — provides WAF, DDoS protection, and CDN
Sucuri — specialises in website security with Australian support options
Wordfence (for WordPress) — application-level firewall

OWASP specifically recommends WAFs as a defence-in-depth measure alongside secure coding practices.

Restrict File Permissions

Overly permissive file permissions are exploited by attackers to write malicious files. Recommended settings:

Directories: 755 (owner can write; others can only read and execute)
Files: 644 (owner can write; others can read only)
wp-config.php: 440 or 400 (no public read access)

Set permissions via SFTP client or SSH:

bash find /home/yourusername/public_html/ -type d -exec chmod 755 {} ; find /home/yourusername/public_html/ -type f -exec chmod 644 {} ; chmod 400 /home/yourusername/public_html/wp-config.php

Disable PHP Execution in Upload Directories

Hackers frequently upload PHP shells disguised as images. Prevent PHP from running in your uploads folder by adding a custom .htaccess file inside /wp-content/uploads/:

apache <Files *.php> deny from all </Files>

Enable Two-Factor Authentication on Your CMS

For WordPress, plugins like WP 2FA or Google Authenticator add MFA to your admin login. This single measure prevents the vast majority of brute-force and credential-stuffing attacks.

Set Up Automatic Backups Offsite

Configure automated daily backups that are stored offsite — not just on your hosting server. Options include:

UpdraftPlus backing up to Google Drive or Amazon S3
Your host's automated backup service (verify it is actually running and test a restore)
A dedicated backup service

The ACSC recommends following the 3-2-1 backup rule: 3 copies of your data, on 2 different media types, with 1 stored offsite.

Step 6 — Request a Google Review and Restore Your Search Rankings

If Google flagged your site as dangerous, your search traffic will have dropped significantly. Once your site is clean:

Log in to Google Search Console (https://search.google.com/search-console)
Navigate to Security & Manual Actions → Security Issues
Review the specific issues Google found
Click Request a Review and describe the steps you took to clean and secure the site
Google typically responds within a few days to a few weeks — be thorough and honest in your description

Google Search Central's documentation on hacked sites (https://developers.google.com/search/docs/monitor-debug/security/hacked) is the definitive reference for this process.

Also check Bing Webmaster Tools if Bing is a meaningful traffic source for your site.

Step 7 — When to Hire a Professional

Some situations require expert help. Consider engaging a professional Australian cybersecurity firm if:

You cannot identify the source of the hack after thorough investigation
Your site has been re-hacked after cleanup (indicates a persistent backdoor)
You process payments and suspect cardholder data was compromised (you likely have PCI DSS obligations)
The breach involved personal data of Australian residents (NDB scheme obligations)
You lack the technical access or confidence to safely clean server files

When selecting a provider, look for certifications such as CREST (an internationally recognised cybersecurity accreditation body with an Australian presence) or membership of the Australian Information Security Association (AISA). Always verify credentials and ask for a written scope of work before engaging.

Ongoing Security: Staying Protected After Recovery

Recovery is the start, not the end. Build these habits into your regular operations:

Monthly: Review user accounts and remove those no longer needed
Weekly: Check your hosting and CMS for available updates
Daily: Monitor Google Search Console for security alerts
Continuously: Subscribe to the ACSC's free alert service at cyber.gov.au to receive threat intelligence relevant to Australian businesses
Annually: Commission a professional penetration test or vulnerability assessment if your site handles sensitive data

Frequently Asked Questions

How long does hacked website recovery take in Australia?

Recovery time depends on the severity and your technical skill level. A straightforward malware cleanup on a WordPress site can take 4–8 hours for someone comfortable with server access. If you are restoring from backup, you may be back online within 1–2 hours. Complex incidents involving database injection, persistent backdoors, or regulatory obligations can take several days, particularly if you engage a cybersecurity firm.

Will my Australian hosting provider help me recover from a hack?

Most reputable Australian hosting providers will assist you, especially if malware is affecting server performance or other customers. They will typically scan your account, identify malicious files, and help you understand what was found. However, the actual cleanup and security remediation is generally your responsibility. Some hosts offer premium managed security services that include cleanup.

Do I have to notify customers if my website was hacked in Australia?

If personal information about Australian residents was accessed or exposed, you may be required to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches (NDB) scheme. This applies to organisations with an annual turnover above $3 million, as well as certain smaller businesses handling health records or credit information. Seek legal advice promptly if you believe personal data was compromised.

Can I recover my Google rankings after a hack?

Yes — in most cases, Google rankings recover fully once your site is cleaned and you have successfully completed the review request process in Google Search Console. The timeline varies: some sites recover within weeks, others take a few months. The faster you act, the less long-term ranking damage you will suffer. Avoid bringing a site back online before it is fully clean, as Google may flag it again immediately.

How much does professional hacked website recovery cost in Australia?

Costs vary widely. Basic malware removal services from specialist providers typically start around AUD $150–$300 for a straightforward CMS site. More complex incidents involving forensic investigation, persistent backdoors, or regulatory compliance work can cost several thousand dollars.

Hacked Website Recovery Help in Australia: A Complete Step-by-Step Guide