You search for your business and Google shows a warning. A customer tells you your website is redirecting to a spam page. Or you log in and find admin accounts you didn’t create. Discovering your website has been hacked is stressful, but acting calmly and in the right order makes a big difference to how quickly you recover.
This guide covers the first steps to take in the first 24 hours, and how to reduce the chance of it happening again.
Signs your website may be hacked
- Visitors are redirected to other websites, often spam, gambling or fake stores.
- Google shows “This site may be hacked” or a browser shows a security warning.
- Strange pages, links or text appear on your site, sometimes only visible to search engines.
- Unknown admin users, new plugins or changed passwords.
- Your host suspends the account or warns about malware or spam sending.
- Emails from your domain start bouncing or landing in spam.
The first 24 hours
1. Don’t panic, and don’t start deleting things
Deleting files at random can destroy evidence of how the attack happened and make a clean restore harder. Take screenshots of what you are seeing, and note the time.
2. Contact your host and your web developer
Your hosting provider can often confirm the issue, isolate the site and help restore backups. If someone manages your website, contact them straight away.
3. Change your passwords
From a device you trust, change passwords for the website admin, hosting account, database, FTP or file access and the email accounts connected to the site. Turn on two-factor authentication wherever possible. Remove any admin users you don’t recognise.
4. Consider taking the site offline temporarily
If the site is sending visitors to harmful pages or collecting data, putting it into maintenance mode protects your customers while it is cleaned. A short outage is better than harming visitors.
5. Find out how far it goes
If you have an online store or collect personal information, work out whether customer data could have been accessed. This affects who you need to tell. If the Privacy Act applies to your business and personal information has been compromised, you may have obligations under the Notifiable Data Breaches scheme. Get advice if you are unsure.
6. Report it
Australian businesses can report cyber security incidents to the Australian Signals Directorate’s Australian Cyber Security Centre, and call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371) for advice. If a crime has occurred, it can also be reported to police.
Cleaning up
- Restore from a clean backup taken before the hack, if one exists. Our guide to website maintenance explains why tested backups matter.
- Find and fix the way in. Restoring a backup without closing the gap, such as an outdated plugin or weak password, often leads to reinfection.
- Update everything: core software, themes and plugins. Remove anything you don’t use.
- Scan the site with a reputable security tool, or have a professional check it.
- Check your email settings and domain records haven’t been changed.
Getting Google’s warning removed
If Google has flagged your site, use Google Search Console. The Security Issues report shows what Google found. Once the site is clean, you can request a review from the same report. Google checks the site again and removes the warning if the problem is fixed. This can take some time, so clean thoroughly before requesting it.
Tell your customers if needed
If customers may have been affected, for example if they were redirected to a harmful site or their data may have been accessed, tell them honestly and explain what you have done. It is uncomfortable, but it protects trust far better than silence.
Preventing it happening again
- Keep software updated and remove unused plugins and themes.
- Use strong, unique passwords and two-factor authentication.
- Limit admin access to the people who need it.
- Keep automatic, off-site backups and test them.
- Use reputable hosting with security monitoring.
- Review your site regularly, or have someone maintain it for you.
Need help now?
Madexify helps small businesses across Pakenham, Officer, Beaconsfield, Berwick, Narre Warren, Cranbourne, Clyde and Bunyip clean up hacked WordPress websites, restore them safely and put maintenance in place so it doesn’t happen again. See our web design and development services, or contact us for help with a hacked website.
Sources: ASD’s ACSC: contact and reporting; Search Console Help: security issues report. Accessed 26 September 2026. This article is general information, not legal advice.
This article is part of our Website Security and Tech Guide. Browse all our guides on the guides page.
