If you need hacked website recovery help in the Netherlands, the most important thing you can do right now is take your site offline or into maintenance mode to stop the damage spreading. Most hacked websites can be fully recovered within 24–72 hours if you follow a structured process. This guide walks you through every step, including the Dutch-specific legal reporting obligations that many site owners overlook.

What Should You Do First When Your Website Gets Hacked?

The moment you suspect a compromise, speed matters — but so does preserving evidence. Do not simply restore a backup and move on, because the vulnerability that let attackers in will still be there.

Step 1: Take the Site Offline Immediately

Put your site into maintenance mode or ask your hosting provider to temporarily suspend it. This prevents visitors from being exposed to malware, phishing pages, or drive-by downloads that could damage your reputation and expose you to liability under Dutch law.

Most Dutch hosting providers — including Antagonist, TransIP, and Versio — offer one-click maintenance mode or server-level IP blocking from their control panels.

Step 2: Change All Passwords Right Now

Change credentials for:

  • Your CMS admin account (WordPress, Joomla, Magento, etc.)
  • Your hosting control panel (cPanel, Plesk, DirectAdmin)
  • Your FTP/SFTP accounts
  • Your database (MySQL/MariaDB)
  • Your domain registrar account
  • Any connected email accounts

Use a password manager to generate passwords of at least 16 characters. Enable two-factor authentication (2FA) everywhere it is available.

Step 3: Preserve Evidence Before Cleaning

Before you delete anything, preserve evidence for both your own investigation and potential reporting to Dutch authorities. Run the following from your server or ask your host to provide:

  • Server access logs (typically at /var/log/apache2/access.log or /var/log/nginx/access.log)
  • Error logs
  • File modification timestamps (find /var/www/html -newer /tmp/reference_file -type f)
  • A full backup of the compromised site (clearly labelled as infected)

How Do You Identify What Was Compromised?

Scan Your Website for Malware

Use reputable, well-established scanning tools:

  • Sucuri SiteCheck (free, cloud-based): scans your public-facing pages for malware signatures, blacklist status, and injected code.
  • Wordfence (WordPress plugin): performs a server-side file integrity scan comparing your core files to the official WordPress repository.
  • MalCare or iThemes Security: also perform deep server-side scans.
  • Google Search Central (formerly Google Webmaster Tools): check the Security Issues report inside Google Search Console — Google flags infected sites and tells you what type of attack it detected.
  • VirusTotal: paste your domain URL to cross-reference it against dozens of antivirus and URL scanners simultaneously.

Check for Common Attack Signatures

Attackers typically do one or more of the following:

  • PHP webshells: rogue files like shell.php, c99.php, or r57.php placed in upload directories, giving the attacker persistent remote control.
  • Database injections: spam links or hidden content injected into your database posts, pages, or options tables.
  • .htaccess redirects: malicious redirect rules added to redirect visitors (especially those coming from Google) to spam or phishing sites.
  • Cryptomining scripts: JavaScript injected into your theme files or database to mine cryptocurrency using visitors' browsers.
  • Admin account backdoors: ghost administrator accounts added to your CMS database.

Run this command on a Linux server to find PHP files modified in the last 14 days (adjust the number as needed):

bash find /var/www/html -name "*.php" -mtime -14 -type f

Compare the output against a known-clean list of your legitimate files.

Check Your Database for Injected Content

Log in to phpMyAdmin or run a direct MySQL query to look for spam links hidden in post content:

sql SELECT * FROM wp_posts WHERE post_content LIKE '%<script%'; SELECT * FROM wp_options WHERE option_value LIKE '%eval(%';

Replace wp_ with your actual table prefix if you changed it.

How Do You Clean and Restore a Hacked Website?

Option 1: Restore from a Clean Backup

If you have a verified clean backup taken before the compromise, restoring it is the fastest route. However:

  1. Confirm the backup predates the intrusion using your access logs.
  2. After restoring, immediately patch the vulnerability that was exploited — otherwise you will be re-hacked within hours.
  3. Re-apply any legitimate changes made since the backup.

Most Dutch hosting providers retain at least 14–30 days of daily backups. Check your control panel under "Backups" or "JetBackup."

Option 2: Manual Cleaning

If no clean backup exists, or the backup is also infected, clean manually:

  1. Reinstall core files: Download a fresh copy of your CMS (WordPress, Joomla, etc.) and overwrite all core directories. For WordPress, this means replacing /wp-admin/, /wp-includes/, and the root PHP files — never /wp-content/, which holds your themes and plugins.
  2. Audit plugins and themes: Delete all unused plugins and themes. For active ones, reinstall them fresh from the official repository. Never use nulled (pirated) plugins — they are a leading cause of infections in the Netherlands and globally.
  3. Clean your database: Remove injected scripts, hidden links, and rogue admin accounts.
  4. Restore a clean .htaccess: Delete the existing file and let WordPress regenerate it by saving your permalink settings, or manually recreate it for other platforms.
  5. Remove webshells and backdoors: Delete any suspicious PHP files found during your scan, particularly in /uploads/, /tmp/, and theme directories.

Option 3: Hire a Professional Malware Removal Service

If you are not comfortable with server-level work, several reputable services operate internationally and serve Dutch clients:

  • Sucuri offers a managed website cleanup service with a defined SLA.
  • Wordfence (for WordPress) offers a paid one-time cleanup service.
  • Local Dutch web agencies with a security specialisation can also perform forensic cleanups — search for "websitebeveiliging" or "gehackte website herstellen" to find Dutch-language providers.

OWASP (the Open Web Application Security Project) maintains free resources at owasp.org that professionals use as their cleaning reference standard.

What Are the Dutch Legal Obligations After a Hack?

This section is critical and is frequently ignored by Dutch website owners.

Notification Under the AVG/GDPR

The Netherlands falls under the General Data Protection Regulation (GDPR), known locally as the AVG (Algemene Verordening Gegevensbescherming). If personal data of EU residents was (or may have been) accessed, exfiltrated, or altered by the attacker, you have a legal obligation to:

  1. Report to the Autoriteit Persoonsgegevens (AP) — the Dutch data protection authority — within 72 hours of becoming aware of the breach. Report at autoriteitpersoonsgegevens.nl.
  2. Notify affected individuals if the breach is likely to result in a high risk to their rights and freedoms (e.g., if passwords, financial data, or medical information was exposed).

Failure to notify the AP within 72 hours can result in significant fines. The 72-hour clock starts when you, as the data controller, become aware of the breach — not when it actually occurred.

Report to the Police and NCSC

  • Cybercrime can be reported to the Politie (Dutch National Police) via politie.nl or by calling 0900-8844. For serious incidents, the police have a dedicated cybercrime team (Team High Tech Crime, THTC).
  • The Nationaal Cyber Security Centrum (NCSC), operating under the Ministry of Justice and Security, handles threats to critical infrastructure. If your organisation is part of vital infrastructure, notify the NCSC at ncsc.nl.
  • The Digital Trust Center (DTC), aimed at non-critical businesses, offers guidance and a reporting mechanism for Dutch entrepreneurs at digitaltrustcenter.nl.

Report to SIDN (for .nl Domain Issues)

If your .nl domain was taken over or used in an attack, contact SIDN (Stichting Internet Domeinregistratie Nederland), the registry for .nl domains, at sidn.nl. They can assist with domain-level recovery and abuse cases.

How Do You Harden Your Website to Prevent Future Attacks?

Cleaning is only half the job. CISA (the U.S. Cybersecurity and Infrastructure Security Agency), OWASP, and the NCSC all emphasise that post-incident hardening is mandatory, not optional.

Update Everything

  • Update your CMS core, all plugins, all themes, and all server-side software (PHP version, Apache/Nginx, MySQL) immediately.
  • Enable automatic background updates for minor CMS versions where possible.
  • Check that you are running a PHP version still receiving security updates — PHP 7.4 and below are end-of-life. In 2025, PHP 8.1 is the minimum recommended version.

Implement a Web Application Firewall (WAF)

A WAF sits in front of your website and blocks malicious requests before they reach your server. Options include:

  • Cloudflare (free tier available, with paid security features)
  • Sucuri WAF (DNS-level firewall)
  • Wordfence (application-level firewall for WordPress)

Restrict File Permissions

On a Linux server, the recommended permissions are:

  • Directories: 755
  • Files: 644
  • wp-config.php (WordPress): 600 or 640

Set these with: bash find /var/www/html -type d -exec chmod 755 {} ; find /var/www/html -type f -exec chmod 644 {} ; chmod 600 /var/www/html/wp-config.php

Disable File Editing in the CMS

In WordPress, add this line to wp-config.php to prevent attackers from editing theme and plugin files through the admin dashboard:

php define('DISALLOW_FILE_EDIT', true);

Set Up Monitoring and Alerting

  • Uptime monitoring: Services like UptimeRobot or Better Uptime alert you the moment your site goes down or starts returning errors.
  • File integrity monitoring: Wordfence, Sucuri, or server-level tools like AIDE (Advanced Intrusion Detection Environment) alert you when core files change.
  • Log monitoring: Review your server logs weekly, or use a log analysis tool.

Regular Backups

Follow the 3-2-1 backup rule: keep 3 copies of your data, on 2 different media types, with 1 stored offsite (e.g., in a separate cloud account not connected to your hosting). Test your restores quarterly.

How Do You Get Google to Remove the Hacked Warning?

If Google has flagged your site with a "This site may be hacked" or "Deceptive site ahead" warning, you need to:

  1. Verify your site in Google Search Console if you have not already.
  2. Go to Security Issues in the left menu and review all flagged URLs.
  3. Clean your site completely (see above).
  4. Click Request a Review inside the Security Issues report.
  5. In your review request, clearly explain what was compromised, what you cleaned, and what hardening measures you have taken.

According to Google Search Central, reviews typically take a few days to a few weeks. The warning will be removed once Google's reviewers confirm the site is clean. Submitting a review request before fully cleaning the site will reset the review clock.

Frequently Asked Questions

How long does hacked website recovery take in the Netherlands?

For a straightforward infection with a clean backup available, recovery can take as little as a few hours. A manual cleanup without a backup — involving forensic analysis, file-by-file review, and database cleaning — typically takes 24–72 hours for an experienced professional. Complex attacks on large e-commerce sites can take several days.

Am I legally required to report a website hack in the Netherlands?

Yes, in most cases. Under the GDPR/AVG, if the hack involved any personal data of EU residents, you must report it to the Autoriteit Persoonsgegevens within 72 hours. You may also want to file a cybercrime report with the Politie. Failure to report a qualifying data breach can result in significant fines from the AP.

My Dutch hosting provider says the hack is not their responsibility — is that correct?

Generally, yes. Unless the attack exploited a vulnerability in the hosting infrastructure itself, the security of your web application (CMS, plugins, themes, code) is your responsibility as the site owner. However, your host is obliged to help you investigate, provide logs, and restore from server-level backups where these exist. Check your hosting agreement for specifics.

Can I recover my site if I have no backup?

Yes, though it is more difficult and time-consuming. You will need to manually clean every compromised file and database entry. Using a tool like Sucuri's malware removal service or a local Dutch web security agency is strongly recommended in this scenario. After cleaning, implement an immediate backup strategy so this situation never recurs.

How did my website get hacked in the first place?

The most common causes in the Netherlands and globally, according to OWASP's Top 10, include: outdated CMS plugins or themes with known vulnerabilities, weak or reused passwords, nulled (pirated) premium plugins containing malicious code, insecure shared hosting environments where one compromised site infects neighbours, and brute-force attacks against admin login pages. A post-incident forensic review of your server logs will usually reveal the exact entry point.