Detecting a hack: the warning signs
Hackers rarely announce themselves. These are the most common signs that a site has been compromised. Tick any you recognize — if even one or two apply, treat it seriously and move to the next section.
Noticing any of these does not confirm a hack — sites glitch for innocent reasons too. But it does mean you should stop and investigate before assuming everything is fine. If two or more apply, go straight to the next section and begin the response checklist.
If you suspect you've been hacked
Follow this checklist in order. Work through one step at a time — each step lights up as you reach it, and completed steps fade so you always know exactly where you are.
Don't panic — and don't keep clicking around
Frantic clicking can damage evidence or trigger more of the hack. Take a breath. Open a new note to record what you see and the time you saw it. A calm, written record helps you and any expert you bring in later.
Change your email password from a different, trusted device
Start with the email tied to your website, because a hacker there can reset everything else. Use a phone or computer you're confident is clean — not the one you were just using on the affected site.
Change your website's admin password and turn on two-step sign-in
If you can still log in, change the admin password immediately and enable two-step sign-in (2FA). This may kick the hacker out if they were relying on your old password.
Take the site offline if it's harming visitors
If the site is sending visitors to scams or showing warnings, put up a temporary ‘maintenance’ page or ask your host to pause it. Protecting your customers' trust matters more than a few hours of downtime.
Remove any admin or FTP accounts you didn't create
Look through the user list in your admin panel and your hosting account. Delete or disable every account you don't recognize — these are often the backdoor the hacker is using to stay in.
Run a full malware scan (Wordfence or Sucuri)
If you have a scanner installed, run a deep scan and follow its instructions to quarantine or remove anything it finds. If you don't, Sucuri offers a paid cleanup service that can clean a hacked site for you.
Restore from a clean backup if you have one
If your host keeps backups, restore to a version from before the hack. Then immediately update your site's software and plugins, since outdated software is often how the hacker got in.
Change every password the hacker could have seen
That includes the admin panel, FTP, database, hosting control panel, and any connected services. Use a password manager to generate new, unique passwords for each one.
Tell the people who need to know
If customer data may have been taken, notify affected customers and, where required by law, the relevant authorities. Honesty and speed protect your reputation far more than silence does.
Bring in a professional if you're unsure
If anything feels beyond you — and it's okay if it does — contact a website security service (Sucuri, or your host's support team) and hand them your written record. That's exactly what they're there for.
In a true emergency — if your site is actively harming visitors or you've lost all access — contact your hosting provider's support immediately and ask for their security or abuse team. They can often isolate the problem from their end within minutes.
