Website got hacked 10 essential hacked site recovery steps to restore and secure your website

Website Got Hacked? 10 Essential Hacked Site Recovery Steps to Restore and Secure Your Website

Rumaan Khan

August 4, 2025

Category 1

---

When your website gets hacked it can feel like the digital version of a break-in. One day your site is up and running and the next you are staring at a defaced homepage, strange redirects, or worse, an offline site flagged by Google for malware.

You are not alone. Sites large and small are compromised every day, and most break-ins succeed for boring reasons: an outdated plugin, a reused password, or an admin account nobody owns any more. Recovery is usually possible if you act fast, stay calm, and follow the right hacked site recovery steps.

In this guide we walk through what to do first, how to fix the damage, and how to make sure it does not happen twice. Order matters more than speed: cleaning a site before you copy it, or resetting passwords while the backdoor is still installed, turn a bad afternoon into a bad month.

If your site is offline right now, work through the ten steps below in sequence. Each one assumes the previous step is finished.

---

⚠️ Signs Your Website Has Been Hacked

Before we dive into the recovery process, let us identify the most common signs of a hack:

• Your homepage has been defaced.
• Your website is redirecting to unrelated or malicious sites.
• Visitors report malware warnings or security alerts.
• Google Search Console shows a security issue.
• Strange new users have been added to your admin panel.
• Your traffic has suddenly dropped.
• Your hosting provider suspends your site due to a malware warning.
• Your site sends email that you never wrote it.
• Search results for your brand show spam pages you did not create.
• Unknown files appear in your uploads folder.

One sign is enough to act. Two or three together usually mean the site is being used, not just vandalised. Take screenshots and note the time before you change anything.

---

🧯 Step 1: Stay Calm and Disconnect Immediately

Yes, it is scary, but panicking will not help. The first recovery step is to minimise the damage.

What You Should Do:

• Take the site offline. Put it in maintenance mode or ask your hosting provider to suspend it temporarily.
• Notify your team. Alert your developers, hosting support, or any technical party involved.
• Stop logins. Disable login access if possible to prevent attackers from doing more damage.

Taking the site down is not defeat. While it is offline nothing can be scraped, no spam leaves your domain, and visitors are shielded from whatever script was being served. Record what you switched off and when.

Use the calmest method that works. Maintenance mode is fine when your control panel and database look trustworthy; if the account feels compromised, ask the host to suspend the site rather than signing in to test it.

---

🕵️‍♂️ Step 2: Identify the Hack Type

Before cleaning anything, you need to know what kind of hack you are dealing with, because the evidence shapes every decision that follows.

Common Types of Website Hacks:

• Defacement: Hackers change the homepage or add offensive content.
• Redirect Hack: Visitors are sent to spam or phishing sites.
• Malware Insertion: Hidden scripts steal data or infect visitors.
• Spam SEO: Pages filled with spammy links or keywords.
• Backdoor Access: The hacker creates a hidden entry to return later.

These categories overlap. A redirect hack usually means a backdoor was installed too, and spam pages are often the visible half of a database injection.

Run a public scan for a second opinion:

• Sucuri SiteCheck
• Wordfence (for WordPress)
• Google Safe Browsing
• Or get help from RestoreWebpages.com if you are not tech-savvy.

Scanners are a starting point, not a verdict. They are good at known payloads and poor at freshly planted code, so a clean report does not clear the site.

---

🧪 Step 3: Scan for Malware and Backdoors

Once you know the type of attack it is time to scan your files and database properly.

How to Do It:

• Use security plugins (Wordfence, Sucuri, iThemes Security).
• Access your files via cPanel, FTP or SSH and look for unknown PHP files, recently modified files, and suspicious base64 or eval() code.

find . -type f -mtime -7 -name "*.php"
grep -rIl --include="*.php" -e "eval(" -e "base64_decode" .

Start with files that changed recently, then work outwards and compare them against clean core files from the official source. A file that looks odd to you may be normal, and a second scan afterwards is worth the time.

do not forget to check:

• .htaccess files
• wp-config.php or configuration files (for other CMS)
• Unfamiliar admin accounts

Check these three on every platform, not just WordPress. Redirect rules usually live in .htaccess, stolen keys and injected code in the configuration file, and an extra admin account is the cheapest way back in. Also look for scheduled tasks and unknown SSH keys or FTP accounts, which survive a site restore.

Pro Tip: Backdoors often look like legitimate files but are disguised with strange names or buried in unused folders.

---

💾 Step 4: Backup Everything Before Making Changes

Before you start cleaning, create a full backup, yes, even of the hacked version.

Why?

• If something goes wrong, you can roll back.
• Security professionals might need to analyse the infection.
• You will want a reference point during restoration.

Back up all three layers: files, database and configuration. Store the copy where the compromised account cannot reach, such as your own computer, because a backup kept inside the hacked site can be deleted by the same attacker.

Use backup tools like:

• UpdraftPlus (for WordPress)
• cPanel Backup Wizard
• Or a manual copy via FTP plus a database export from phpMyAdmin

Save it on your local system or a secure cloud drive, then open the archive and check the files are really there.

---

🧹 Step 5: Remove Malware and Malicious Code

Now it is time to clean the infected files. The goal is a site containing no code the attacker wrote, not one that merely looks normal again.

Manual Cleanup (Advanced Users):

• Remove or replace infected files with clean versions.
• Delete unknown scripts or suspicious code.
• Reinstall fresh copies of the core CMS files.

Replace rather than repair wherever you can. Editing a file you have never read means guessing what the clean version looked like, and one surviving line is enough to keep access. Reinstalling the core gives you a known-good baseline. Note the file paths as you go, because they tell you later where the entry point was. Compare themes and plugins against clean copies.

Using a Cleanup Tool (Beginner Friendly):

• Sucuri or Wordfence offer automatic malware cleanup.
• Your hosting provider might offer malware removal assistance.

Automated cleanup is a good first pass, then verify it yourself. Run a second scan from a different tool, because scanners commonly miss injected database content and code hidden inside theme templates. If a scan reports clean while the symptom is still there, treat the site as unverified and get a human to look.

Optional but Safe: Use RestoreWebpages.com for full-site malware cleanup and recovery assistance.

---

🔐 Step 6: Reset All Passwords & Remove Backdoors

Hacked site recovery steps must include a full reset of every access point, done only after the files are clean.

What to Change:

• Admin panel password
• Hosting account password
• FTP/SFTP credentials
• Database passwords
• Email accounts connected to the website
• CMS users and roles (delete unknown users)

Work from the outside in: hosting first, then FTP and database, then the CMS, then email. Delete unknown users rather than demoting them, and revoke active sessions so a cookie the attacker already holds stops working. While you are there, check for password reset emails you did not request and for stray application passwords.

Why? Hackers often create backdoor access so they can return. Resetting everything blocks their path, and resetting too early simply hands them the new credentials.

---

🔄 Step 7: Restore from a Clean Backup (If Available)

If your backup is clean and recent, from before the hack, it is often easier to restore the entire website than to clean it piece by piece.

How to Do It:

• Use your backup plugin (UpdraftPlus, JetBackup or similar)
• Use cPanel or the hosting dashboard to restore a full site
• Reupload files and the database using FTP and phpMyAdmin

Check the date on the archive first. The safest copy is the last one taken before the first sign of infection, and a weekly schedule may mean the only backup you hold already contains the problem. Restore into a hidden folder if your host allows it, check it, then go live.

⚠️ Important: Only restore a backup if you are sure it is clean. Otherwise you may reintroduce the malware and the entry point that let it in.

If you have no clean backup, RestoreWebpages.com can help rebuild your site from public archives or partial backups.

---

🛡️ Step 8: Secure Your Website (So It Doesn’t Happen Again)

Recovery is only half the battle. The other half is making sure it never happens again, which means closing the route the attacker used rather than just erasing the damage.

Essential Security Measures:

• Install a security plugin (Wordfence, Sucuri, MalCare)
• Enable firewall protection
• Use two-factor authentication for admin login
• Keep themes, plugins and the CMS updated
• Disable file editing from inside the CMS
• Limit user access and roles
• Scan for vulnerabilities on a schedule

Work out which of these closes your specific hole. An unpatched plugin needs updating, a reused password needs changing everywhere it was reused, and an account nobody claims needs deleting. Our guide to the best security plugins for protecting your website compares the options if you are starting from scratch.

Pro Tip: A site that is cleaned but not hardened is still a target, because the original weakness is still there.

---

📝 Step 9: Notify Affected Users and Remove Blacklists

If the hack affected your users, through stolen data, malware or phishing pages, transparency is essential.

Actions You May Need to Take:

• Notify users by email, especially if user data was involved
• Report to Google Search Console and request a malware review
• Submit blacklist removal requests to browser and antivirus vendors
• Inform your hosting provider and request a server-level scan

Tell people what happened, what data was involved and what they should do now, in plain language. Advice about changing passwords and watching financial accounts is more useful than reassurance, and it costs you nothing to include.

Ask a professional adviser about notification duties too. If personal data was exposed, the rules about who must be told and how quickly are set by your location and sector.

---

🚀 Step 10: Set Up Regular Backups and Monitoring

One of the most crucial hacked site recovery steps is prevention through automation.

Tools for Scheduled Backups:

• UpdraftPlus / BlogVault / JetBackup
• Set backups to run daily or weekly
• Store copies in the cloud (Google Drive, Dropbox, Amazon S3)

Frequency should match how much you would mind losing. A daily backup of a site that changes every day is a reasonable default, and for a store or booking site it is the minimum rather than the maximum. Keep one copy outside the hosting account, and test a restore once so you know the archive is not empty when you need it.

Monitoring Tools:

• UptimeRobot alerts you when your site goes down
• Sucuri Monitor tracks blacklists and security threats
• Google Search Console reports indexing and site health

Monitoring is what turns a bad week into a bad hour. Downtime alerts, blacklist checks and scheduled scans catch a problem while it is still small, provided they go to a channel someone actually reads and more than one person can see them. Review them weekly, and give one person ownership. Never assume your site is safe.

---

💬 Real Talk: Do You Need Professional Help?

If all this sounds overwhelming, you are not alone. There is no shame in admitting you are not comfortable editing server files when a business is on the line.

That is where website recovery experts come in. Services like RestoreWebpages.com specialise in:

• Removing malware
• Restoring hacked websites
• Rebuilding broken pages
• Recovering content from public archives
• Preventing future attacks

Ask for a written summary of what was found and changed, and keep it with your backup copies.

---

Final Thoughts: Stay Vigilant, Not Fearful

Having your website hacked is a nightmare, but it does not have to be the end of your online presence. With quick action and the right hacked site recovery steps you can not only recover your site but make it stronger than it was before.

If there is no usable backup, the content is often not gone. Web archives may hold copies of your pages, and our guide to using the Wayback Machine to restore a website explains how to pull them down. If your attempts return Wayback Machine error 429, that is a rate limit rather than a missing page, and it has its own fix.

Take this experience as a lesson, not a loss. Strengthen your defences, back up your data, and remember that recovery is always possible.

---

✅ Quick Recap: 10 Hacked Site Recovery Steps

The table below is the short version to keep beside you during an incident. Treat the first two steps as urgent and let the rest follow in order.

Step	Action
1️⃣	Disconnect your website
2️⃣	Identify the type of hack
3️⃣	Scan files and database for malware
4️⃣	Back up everything (including the hacked site)
5️⃣	Clean infected files
6️⃣	Reset passwords and remove backdoors
7️⃣	Restore from a clean backup (if available)
8️⃣	Secure your website
9️⃣	Notify users and remove blacklists
🔟	Set up backups and continuous monitoring

---

Need help recovering your hacked site?
Visit RestoreWebpages.com for website restoration, malware removal and full recovery.