If you need hacked website recovery help in Singapore, the most important thing you can do right now is act quickly — every minute your site stays compromised puts your visitors, your data, and your search rankings at greater risk. Most website owners can begin the recovery process themselves using the structured steps below, and for complex infections, Singapore has a growing ecosystem of cybersecurity professionals and official resources ready to assist. This guide covers everything from the moment you suspect a breach to hardening your site so it never happens again.

How Do I Know My Website Has Actually Been Hacked?

Before you panic, confirm the compromise. Hackers are not always obvious about their presence — many prefer to stay hidden so they can continue exploiting your site over time.

Common Signs of a Hacked Website

  • Unexpected redirects: Your homepage or product pages silently redirect visitors to spam, gambling, or phishing sites.
  • Defacement: Your homepage has been replaced with a political message or a hacker's calling card.
  • Google warning in search results: Google Search Central's Safe Browsing technology flags your site with "This site may be hacked" or "Deceptive site ahead" in Chrome.
  • Hosting provider suspension: Your Singapore hosting provider (such as Vodien, Exabytes, or SingNet) has taken your site offline due to malware.
  • Unknown admin accounts: You find user accounts in your CMS dashboard that you did not create.
  • Slow performance or CPU spikes: Your server is being used as part of a botnet or for cryptocurrency mining.
  • Spam emails traced back to your domain: Recipients report receiving phishing emails that appear to come from your domain.

Use Free Diagnostic Tools First

Run these checks before touching anything:

  1. Google Safe Browsing Transparency Report — visit https://transparencyreport.google.com/safe-browsing/search and enter your domain.
  2. Sucuri SiteCheck — https://sitecheck.sucuri.net scans publicly visible malware, blacklist status, and outdated software.
  3. VirusTotal — paste your URL into https://www.virustotal.com to check it against 70+ security vendors simultaneously.
  4. Fetch as Google — inside Google Search Console, use the URL Inspection tool to see what Googlebot actually sees when it crawls your pages. Hackers often serve malware only to search engine crawlers (cloaking), so this is critical.

Immediate Steps: What to Do the Moment You Confirm a Hack

Step 1 — Take the Site Offline or Enable Maintenance Mode

Put your site into maintenance mode immediately. This limits further damage and stops visitors from being exposed to malware or phishing content. In WordPress, a plugin like WP Maintenance Mode works quickly. Alternatively, ask your hosting provider to temporarily suspend the site while you work on it.

If you manage your own server, you can block public traffic with a simple nginx or Apache rule while retaining your own IP access for investigation.

Step 2 — Change All Passwords Immediately

Change every credential associated with the site before you start cleaning, so the attacker cannot undo your work:

  • CMS admin panel (WordPress, Joomla, Drupal, etc.)
  • Hosting control panel (cPanel, Plesk, or your provider's custom panel)
  • FTP/SFTP accounts
  • Database passwords in your wp-config.php or equivalent config file
  • Email accounts hosted on the same domain
  • Your domain registrar account (e.g., GoDaddy, Namecheap, or Singapore's own SGNIC for .sg domains)

Use a password manager and generate unique passwords of at least 20 characters for each.

Step 3 — Notify Your Hosting Provider

Contact your Singapore hosting provider's support team immediately. Reputable providers will:

  • Tell you whether they have already detected the infection
  • Provide server-level logs (access logs, error logs) that are invaluable for finding how the attacker got in
  • Sometimes assist with malware scanning at the server level
  • Restore from a server-side backup if one exists

Step 4 — Report the Incident to the Relevant Authorities

In Singapore, website owners are encouraged to report cybersecurity incidents through the following official channels:

  • Singapore Computer Emergency Response Team (SingCERT) — operated by the Cyber Security Agency of Singapore (CSA). File a report at https://www.csa.gov.sg/singcert/reporting. SingCERT provides advisories, technical guidance, and can coordinate response for serious incidents.
  • Personal Data Protection Commission (PDPC) — if the hack resulted in a data breach involving personal data of Singapore residents, you are legally obligated under the Personal Data Protection Act (PDPA) to notify the PDPC of a breach involving 500 or more individuals, or where significant harm is likely. Visit https://www.pdpc.gov.sg for mandatory breach notification details.
  • Singapore Police Force Cybercrime Command — for criminal incidents (ransomware, extortion, financial fraud), file a report at your nearest Neighbourhood Police Centre or via the SPF e-report portal.

How to Clean a Hacked Website Step by Step

Step 5 — Back Up Everything, Even the Infected Version

This sounds counterintuitive, but back up the current (compromised) state of your site before making any changes. You need this for:

  • Forensic investigation to understand the attack vector
  • Comparison against clean files to identify exactly what changed
  • Legal evidence if you pursue a criminal complaint

Use your hosting control panel's backup tool, or use rsync or SFTP to download a complete copy of your web root and database.

Step 6 — Identify All Infected Files

For WordPress Sites (the most common CMS in Singapore)

WordPress powers a large proportion of Singapore business websites. Malware typically hides in:

  • wp-content/uploads/ — PHP files should never exist here; any .php file in this directory is almost certainly malicious
  • wp-content/plugins/ — especially in abandoned or nulled (pirated) plugins
  • wp-content/themes/ — particularly in functions.php, which is executed on every page load
  • Root directory files — index.php, .htaccess, and any unfamiliar .php files

Command-line scan for PHP files in uploads (run via SSH):

bash find /home/youraccount/public_html/wp-content/uploads/ -name "*.php" -type f

Replace /home/youraccount/public_html/ with your actual web root path — this varies by host but is commonly structured this way in cPanel environments.

Scan for recently modified files (last 7 days):

bash find /home/youraccount/public_html/ -mtime -7 -type f -name "*.php"

Check .htaccess for malicious redirect rules. Open the file with a text editor and look for RewriteRule directives pointing to external domains you do not recognise.

Using a Malware Scanner

Install and run a server-side scanner. Reliable options include:

  • Maldet (Linux Malware Detect) — open source, works well in shared hosting environments
  • ClamAV — open source antivirus for Linux servers
  • Wordfence Security (WordPress plugin) — provides a file integrity scanner that compares your core files against the official WordPress repository checksums
  • Sucuri Security (WordPress plugin) — monitors file changes and known malware signatures

Step 7 — Remove Malicious Code and Files

Once identified, remove infected files carefully:

  1. Delete clearly malicious files (e.g., PHP shells in the uploads folder) outright.
  2. Replace core CMS files with fresh, official copies. For WordPress, download the exact same version from https://wordpress.org/download/releases/ and overwrite core files — do not overwrite wp-config.php, wp-content/, or .htaccess.
  3. Manually clean injected code. Malware is often injected as a single obfuscated line at the top or bottom of legitimate PHP files. Look for functions like base64_decode, eval, gzinflate, str_rot13, preg_replace with the /e modifier, and assert. These functions have legitimate uses but are almost universally present in PHP malware.
  4. Clean your database. Use phpMyAdmin or the MySQL command line to search the database for injected <script> tags, iframe code, or spam links. In WordPress, run a search across the wp_posts and wp_options tables. The wp_options table, particularly the siteurl and home entries, is a common injection point.

sql SELECT * FROM wp_options WHERE option_value LIKE '%eval(%'; SELECT * FROM wp_posts WHERE post_content LIKE '%<iframe%';

Step 8 — Update Everything

After cleaning, update every component before bringing the site back online:

  • CMS core (WordPress, Joomla, Drupal)
  • All plugins and extensions
  • All themes
  • PHP version on your server (speak to your host — many Singapore sites still run PHP 7.4 or older, which is end of life)
  • Any third-party scripts or libraries (jQuery, Bootstrap, etc.)

OWASP (the Open Web Application Security Foundation) consistently identifies using components with known vulnerabilities as one of the top web application security risks in the OWASP Top 10. Keeping software updated is your single most impactful defence.

Step 9 — Restore from a Clean Backup (If Available)

If you have a verified pre-hack backup, restoring from it is often faster and more reliable than manual cleaning. Confirm the backup date predates the infection — check your server access logs to identify when the attacker first accessed your system.

Most cPanel hosting accounts include JetBackup or Softaculous with automated daily backups. Log in to your control panel and look under Backup or JetBackup to restore individual files, databases, or full accounts.

Important: Restoring a clean backup without also patching the vulnerability that allowed the hack means you will be re-hacked, often within hours. Always identify and fix the entry point first.

How to Get Your Site Off Google's Blacklist

Being blacklisted by Google is one of the most damaging consequences of a hack for Singapore businesses that rely on organic search traffic.

Step 10 — Request a Security Review from Google

Once your site is clean:

  1. Log in to Google Search Console (https://search.google.com/search-console/).
  2. Navigate to Security & Manual Actions > Security Issues.
  3. Review the issues listed — Google will describe the type of malware or hacking it detected.
  4. Once you are confident the site is clean, click Request Review.
  5. In the text box, describe specifically what you found, how you removed it, and what steps you took to prevent recurrence. Be detailed — vague submissions are more likely to be rejected.

Google states in its Search Central documentation that review requests typically take a few days to a few weeks. If your review is rejected, Google will tell you why — address those issues and submit again.

Hardening Your Website After Recovery

Cleaning up is only half the job. CISA (the U.S. Cybersecurity and Infrastructure Security Agency), SingCERT, and security frameworks like OWASP all emphasise that post-incident hardening is essential to prevent re-infection.

Implement a Web Application Firewall (WAF)

A WAF sits between your visitors and your server, blocking malicious requests before they reach your application. Cloud-based WAF options that are widely used in Singapore include Cloudflare (which also has a Singapore data centre for low-latency protection) and Sucuri Firewall. Both offer free or affordable tiers suitable for SMEs.

Enable Two-Factor Authentication (2FA)

Enable 2FA on every administrative account — your CMS, your hosting panel, your domain registrar, and your email. This single step prevents the vast majority of credential-stuffing and brute-force attacks. Authenticator apps such as Google Authenticator or Authy are preferred over SMS-based 2FA in Singapore, given the documented risk of SIM-swapping.

Restrict File Permissions

Incorrect file permissions are one of the most common causes of website compromise in shared hosting environments. As a rule:

  • Directories: 755 (owner can write, everyone else can only read and execute)
  • PHP/HTML files: 644 (owner can write, everyone else can only read)
  • wp-config.php: 400 or 440 (read-only, even for the owner)

Set these via your hosting file manager or via SSH:

bash find /home/youraccount/public_html/ -type d -exec chmod 755 {} ; find /home/youraccount/public_html/ -type f -exec chmod 644 {} ; chmod 400 /home/youraccount/public_html/wp-config.php

Disable XML-RPC if You Don't Need It

In WordPress, xmlrpc.php is a frequent brute-force and DDoS amplification target. If you do not use remote publishing tools or Jetpack, add this to your .htaccess:

apache <Files xmlrpc.php> Order Deny,Allow Deny from all </Files>

Set Up Automated Backups Off-Site

Never rely solely on your hosting provider's backups — a serious server compromise can destroy them too. Use a plugin or script to push automated daily backups to a separate location such as Amazon S3, Google Drive, or Dropbox. In Singapore, Alibaba Cloud's OSS (Singapore region) is also a popular option for businesses already in the Alibaba ecosystem.

Install a Security Monitoring Plugin or Service

After recovery, keep a security plugin active for ongoing monitoring:

  • Wordfence (WordPress) — firewall, malware scanner, and login security
  • iThemes Security Pro (WordPress)
  • Sucuri Security (WordPress/general)

Configure email alerts so you are notified immediately of file changes, failed logins, or new admin accounts.

When to Hire a Professional: Singapore Cybersecurity Resources

If the infection is severe, if you are handling sensitive customer data, or if you simply do not have the technical confidence to clean the site yourself, hiring a professional is the right call.

Where to Find Help in Singapore

  • Cyber Security Agency of Singapore (CSA) maintains a list of certified Managed Security Service Providers (MSSPs) and cybersecurity companies under its Cybersecurity Labelling Scheme and industry resources. Visit https://www.csa.gov.sg to find vetted providers.
  • SMEs Go Digital Programme — administered by IMDA (Infocomm Media Development Authority), this programme provides funding support for Singapore SMEs adopting cybersecurity solutions, including potentially subsidising the cost of professional recovery and ongoing protection services. Check the current list of pre-approved vendors at https://www.imda.gov.sg/SMEsGoDigital.
  • Association of Information Security Professionals (AiSP) — Singapore's professional body for information security practitioners. Their directory can help you find individual consultants with verified credentials.

When hiring a freelancer or agency, ask specifically for evidence of relevant certifications such as CISSP, CEH (Certified Ethical Hacker), OSCP, or CompTIA Security+. Request a post-recovery report detailing the root cause, all changes made, and hardening recommendations.

Frequently Asked Questions

How long does hacked website recovery typically take in Singapore?

For a straightforward malware injection on a standard WordPress site, a competent technical person can complete the cleanup in 4 to 8 hours. Getting off Google's blacklist can add anywhere from 3 to 14 days, depending on how quickly Google's security team processes your review request. Complex attacks involving server-level rootkits, database compromise across multiple sites, or ransomware can take days of professional work to fully remediate.

Am I legally required to report a website hack in Singapore?

It depends on what data was compromised. Under Singapore's Personal Data Protection Act (PDPA), if the breach involves personal data and is likely to cause significant harm, or involves 500 or more individuals, you must notify the PDPC and the affected individuals. Failure to notify when required can result in financial penalties. Even outside mandatory thresholds, reporting to SingCERT is strongly encouraged and helps protect other Singapore organisations from the same threat actor.

Can I recover a hacked website without paying for professional help?

Yes, for many common infections, particularly on WordPress, you can