My Website Is Hacked: The Complete Recovery Checklist

Discovering your website has been hacked is one of the most stressful moments an owner faces. Work through this checklist in order. Skipping steps — especially the early containment ones — is the most common reason sites get re-infected within days of a clean-up.

What Should You Do in the First 15 Minutes?

The first priority is containment, not cleaning. Acting fast here limits how much damage the attacker can do while you work.

1. Put the site into maintenance mode or take it offline. Most hosting control panels have a one-click option. If yours does not, rename your main index file (for example, index.php to index.php.bak) so visitors see a blank or error page rather than malware.
2. Change every password immediately — your hosting control panel, FTP/SFTP accounts, database user passwords, and your CMS admin account. Use a password manager to generate strong, unique credentials for each.
3. Revoke and regenerate API keys and secret tokens stored in your site's configuration files (commonly wp-config.php for WordPress, .env for Laravel-based sites).
4. Notify your hosting provider. Many hosts have a dedicated abuse or security team who can isolate your account, preserve server logs, and sometimes identify the entry point faster than you can alone.

How Do You Assess the Full Extent of the Damage?

Before you start deleting files, you need to understand what the attacker changed. Cleaning blindly often leaves backdoors in place.

• Scan with an external malware scanner. Tools such as Sucuri SiteCheck or VirusTotal's URL scanner analyse your pages from the outside, flagging injected scripts, spam links, and blacklist status across Google Safe Browsing, McAfee, and others.
• Check your hosting file manager or SFTP for recently modified files. Sort all files by "date modified" and look for anything changed around the time you suspect the breach occurred. Pay close attention to core CMS files, theme files, and any PHP file in your uploads directory (PHP files should never normally appear there).
• Review your database for injected content. Common injections include spam links in post content, hidden admin users added to your user table, and malicious JavaScript added to site-wide option fields such as WordPress's siteurl or home options.
• Check Google Search Console. If you have a verified property, Google's Security Issues report will often tell you exactly which URLs it found malware or phishing content on.

Should You Restore From a Backup or Clean Manually?

This is the most important decision in the whole process. Here is a straightforward comparison:

The safest approach for most site owners is to restore a backup that predates the infection, then re-apply any content changes manually. If you cannot identify a clean backup, restore the CMS core and all plugins or themes from their official sources (never from the infected server), and keep only your uploaded media and database content — after scanning both.

Always verify your backup before restoring. A backup taken while the site was already compromised will simply reintroduce the malware.

How Do You Remove Malware Manually If You Have No Clean Backup?

1. Download a fresh copy of your CMS from its official website and compare the core files against what is on your server. Any differences in core files are suspicious and should be replaced.
2. Delete and reinstall all plugins and themes from official repositories. Do not re-upload files from the infected server.
3. Search for common backdoor patterns. Use your hosting file manager's search function or an SSH command such as grep -rl "eval(base64_decode" /path/to/your/site/ to find files containing obfuscated PHP — a hallmark of backdoors. Also search for system(, passthru(, and shell_exec(.
4. Clean your database. Search post content and options for unexpected <script> tags, iframe embeds pointing to unfamiliar domains, and hidden links.
5. Remove any unknown admin users from your CMS user table.

How Do You Confirm the Site Is Clean Before Going Live?

• Run a second external scan after cleaning to confirm no malware is detected.
• Check Google Safe Browsing status at transparencyreport.google.com/safe-browsing/search.
• Ask a trusted colleague to browse several pages and inspect the page source for anything unexpected.
• Confirm no unfamiliar scheduled tasks (cron jobs) exist on your server — attackers often add these to re-infect the site automatically.

How Do You Request Removal From Google's Blacklist?

If Google flagged your site with a "This site may be hacked" warning in search results or a red interstitial warning page, you need to request a review once cleaning is complete.

1. Log in to Google Search Console.
2. Navigate to Security Issues under the Legacy Tools section.
3. Tick "I have fixed these issues" and click Request a Review.
4. Write a brief, honest description of what you found and what you did to fix it.

Google typically processes these reviews within 72 hours for malware, though phishing reviews can take longer. Your site's search rankings may take several weeks to recover fully even after the warning is lifted.

What Must You Do to Stop It Happening Again?

Recovery is only half the job. Without hardening, re-infection rates are high.

• Update everything immediately — CMS core, all plugins, all themes. The majority of successful attacks exploit known vulnerabilities in outdated software.
• Enable a web application firewall (WAF). Services such as Cloudflare (free tier) or Sucuri (paid) sit in front of your site and block malicious traffic before it reaches your server.
• Set up automated, off-server backups. Daily backups stored in a separate location (not just your hosting account) mean that next time — and there is always a next time — recovery takes minutes rather than days.
• Restrict file permissions. PHP files in upload directories should not be executable. Your hosting provider's support team can advise on the correct permissions for your server setup.
• Enable two-factor authentication on every account that has access to your site: hosting, domain registrar, CMS admin, and email.
• Audit your user accounts. Remove any logins that are no longer needed. Every extra account is a potential entry point.
• Monitor continuously. Set up uptime and malware monitoring so you find out about problems within minutes rather than days.

Frequently Asked Questions

How long does website recovery typically take? For a straightforward infection on a CMS site with a clean backup available, a careful recovery takes between two and four hours. Without a backup, or with a complex infection across many files, expect one to three full working days.

Will my site's Google rankings recover after a hack? Yes, in most cases. Once Google lifts its security warning following your review request, rankings generally recover over two to six weeks, provided the technical issues are fully resolved and the site's content was not significantly damaged.

Should I pay a professional to clean my site? If you are not comfortable working with files via SFTP, reading PHP code, or accessing a database, hiring a professional is a sound investment. Services from reputable security companies typically cost between $150 and $500 USD for a single clean-up. Weigh that against the cost of the site being offline or blacklisted for days.

Can I prevent all future hacks? No security measure guarantees complete protection, but keeping software updated, using a WAF, enforcing strong passwords with two-factor authentication, and maintaining regular off-server backups will stop the vast majority of opportunistic attacks that target most small websites.