Recovering from a hacked website

Discovering your website has been hacked is alarming. You may feel embarrassed, angry, or overwhelmed. That is completely understandable, and also completely normal. It happens to businesses of every size, including large, professional ones.

Here is the thing: it is usually fixable. In most cases you are facing a cleanup job, and this guide walks you through every step of it. Most of the steps apply whatever your site is built on. Where WordPress, Squarespace, Shopify, Webflow, Wix and custom-coded sites differ, the guide says so.

Signs that your site may have been hacked

You don't always get a dramatic warning. Look for:

Visitors are redirected to a different website
Google shows a warning label next to your site in search results
Your browser flags the site as dangerous
Pages contain links or text you didn't write
Accounts you don't recognize have appeared in your site's user list, such as admin accounts in WordPress, contributors on Squarespace, staff on Shopify, or collaborators on Wix
Your account's login history shows sign-ins you don't recognize
Your hosting provider suspended your account (if you pay a separate host, as most WordPress sites do)
The Security issues report in Google Search Console shows a warning
Your site is slower than usual or displays strange error messages

If you notice any of these signs, treat it as a likely hack and proceed below. One caution for Squarespace sites: Squarespace says Google's "This site may be hacked" label in search results can be triggered by normal content, and on a Squarespace site was most likely triggered by content you added, not by hackers. Use Google Search Console to find the cause before assuming the worst, but still act on any of the other signs.

First 30 minutes

Contact us. Email support@chykalophia.com with a brief description and a screenshot of what you're seeing. We can assess the situation and tell you exactly what access we need to start.

Take a screenshot of everything suspicious. Capture the defaced content, strange redirects, browser warnings, and any error messages. This is your evidence record.

Take the site offline if it is actively harming visitors. If your site is redirecting visitors to malicious content, hide it right now. Every platform has a way to do this:

WordPress: put it in maintenance mode. Your host may let you suspend the site or take it offline from its control panel, and in WordPress many security plugins have a maintenance mode option.
Squarespace: Site Availability lets you hide your site from all visitors and search engines, or add a password.
Shopify: private mode hides all of your online store's pages from visitors and search engines and shows a landing page instead.
Webflow: unpublish the site from all of its domains, including the staging subdomain, from Site settings or Site actions (you need Site settings access, or ask us). It works immediately, and you can republish the site later. If the site is showcased on Made in Webflow, Webflow says its staging domain can't be unpublished. Password protection is the alternative on a paid Site plan (or a qualifying paid Workspace plan), but it only takes effect once you publish.
Wix: unpublish the site. You keep access to the editor and can publish it again at any time.
Custom-coded: ask your developer to take the site down or roll it back to an earlier deploy they know is safe. On Vercel, new changes won't go live automatically after a rollback until your developer undoes it (see the Custom-coded tab under By platform).

Do not delete anything or restore a backup yet. It is tempting to wipe everything, but doing so destroys the evidence that tells us how the attacker got in. Without knowing the entry point, you risk getting hacked again the same way. A restore can wipe that evidence too: on Wix, for example, restoring a version erases any changes made after it. Contact us before restoring anything, and screenshot and note what changed first. On Squarespace this matters even more: code deleted from a code block, Code Injection or Custom CSS can't be restored, so copy anything suspicious into a document before anyone removes it.

Change your email password first. Whoever controls the email address you log in with can reset your other passwords. Shopify's own steps for a compromised account start here: change the password of the email account you use to log in, then the Shopify password. Use a strong, unique password via your password manager. See how to create strong passwords. While you're in your email, check for forwarding rules or access grants you didn't create.

Lock down your website login. Change the password for whatever you log in to your site with, then shut out anyone else who is signed in:

WordPress: change your WordPress admin password, then your hosting account password in your hosting dashboard.
Squarespace, Shopify, Webflow and Wix: your platform account is your site, so change that account's password. Then check your platform's tab under By platform for how to end other sessions and review logins, where it offers them.
Custom-coded: change the passwords for your hosting account (Vercel, Netlify or similar) and the account where your site's code is stored.

Turn on two-factor authentication now if it isn't on already. WordPress (with a plugin), Squarespace, Shopify, Webflow and Wix all support it. See two-factor authentication.

If you can't log in because the attacker changed your password or login email, start your platform's account recovery straight away. If you can't get into your email either, recover it with your email provider first. On Shopify, if you don't receive a password reset email, contact Shopify Support; Wix has an Account Recovery form. See I can't log in.

Plan for two rounds of password resets

WordPress's own guidance is to force a password reset for every user, especially administrators, early on, so the attacker can't keep making changes while you work. One reset is not enough, though. If malware with a backdoor is still on the site, the attacker can get straight back in whatever you set the password to. On a hosted platform, an extra user or app password the attacker added works the same way, so remove those too. Change the passwords a second time once the site is confirmed clean (see First week).

First 24 hours

Audit who has access. Check your site's list of users for any account you don't recognize, and remove it. On WordPress, log in, go to Users, and immediately delete any suspicious accounts. See WordPress user roles explained. On other platforms, check the contributors, staff or collaborators list: see By platform.

Look for recent changes. On WordPress, your hosting dashboard or FTP access may show recently modified files. Files that changed on the day of the hack, especially in wp-content/themes/, wp-content/plugins/, or wp-content/uploads/, are likely infected. Hosted platforms don't give you the server's files, though Shopify does let you edit your theme's code files. Some keep a history you can check: see By platform.

Scan for malware, or look for code and apps you didn't add. On WordPress, use a security plugin such as Wordfence, or your hosting provider's malware scanner if it has one. Many managed WordPress hosts will scan your site for malware and help you clean it. Ask yours what it offers. On Squarespace, Shopify, Webflow and Wix, the platform runs and secures its own software, so a WordPress-style scan doesn't apply. Instead, look for custom code, embeds and apps you didn't add. On a custom-coded site, your developer checks the code history and recent deploys.

Find out what you can restore. On WordPress, log in to your hosting dashboard and note the date of your last backup made before the hack. You'll need this for the restoration step. Do not delete any backups. On other platforms, what you can restore varies a lot. On Squarespace there is no backup to roll back to, and Shopify has no built-in one (only your own exports or a backup app): see Restoring from a backup. See also how backups work.

Check for Google Search Console alerts. If you have Google Search Console set up, log in and open the Security issues report. If Google has found a problem, the report lists what it found, with sample affected URLs. See what is Google Search Console.

Notify any affected customers if you believe their data may have been accessed. You may have a legal obligation to do so. Consult a lawyer if you're unsure what applies to your business.

By platform

The steps above are the same everywhere. These are the parts that depend on what your site is built on.

The rest of this guide is written with WordPress in mind: the cleanup, restore and hardening sections below all apply to you. If your host suspended your account, see the question on that below.

Cleaning the site

This section is primarily for reference. We strongly recommend letting us handle the actual cleanup rather than doing it yourself. Incomplete cleanup leaves backdoors open.

How hacks typically work

On Squarespace, Shopify, Webflow and Wix, the platform runs and secures its own software. Their own security advice focuses on your login (passwords, two-factor, who has access) and on third-party code or apps you add. On a hosted platform, cleanup means removing code, apps and users that shouldn't be there, putting right anything the attacker changed, and locking down the account (see By platform).

WordPress hacks usually come in through one of these:

Outdated plugins or themes: one of the two most common routes in. Attackers use automated tools to find sites running known-vulnerable versions.
Weak, reused or stolen passwords: the other common route. Attackers try common passwords or ones from data breaches.
Compromised hosting environments: less common, but possible if your host has a security issue.
Abandoned plugins that are no longer maintained, so known holes never get patched.
File upload vulnerabilities in a form or plugin.

Your hosting provider's security logs, or a security plugin's log, may show the attack path. A professional cleanup service will typically identify it as part of the work.

The diagram below shows how a typical WordPress hack works.

This is why a thorough cleanup checks every file, the database and every user account, not just the infection you can see.

Read this as text

How they get in. Outdated plugins or themes, and weak, reused or stolen passwords, are the two most common routes. A compromised hosting environment is less common, but possible.

What they plant. Injected code in theme, plugin and upload files, and in the database: spam links, redirect scripts and admin backdoors.

How they stay. Malware often places copies of itself in several locations and installs backdoors so the attacker can return. Unauthorized user accounts and application passwords do the same job.

Removing one visible infection while missing a hidden one means the attacker simply comes back.

What a thorough cleanup involves

On WordPress, a thorough cleanup involves:

Replacing all core WordPress files with fresh copies from WordPress.org
Scanning every theme and plugin file for injected code
Checking the database for injected spam links, redirect scripts, and admin backdoors
Removing all unauthorized user accounts and application passwords
Updating all passwords (WordPress, hosting, FTP/SFTP, database)
Updating all plugins, themes, and WordPress core to current versions
Reviewing and hardening file permissions

DIY cleanup often misses things

Malware often places copies of itself in several locations and installs backdoors so the attacker can return. Removing one visible infection while missing a hidden one means the attacker simply comes back. Professional cleanup is worth it.

If your site runs on WordPress and you don't use us, WordPress's own guidance points to security plugins such as Wordfence and Sucuri for scanning a site. Sucuri takes paid malware removal requests and cleans the site for you. On Wordfence's side, the paid Care plan includes hands-on support with security incidents, and the Response plan adds 24/7 support from Wordfence's incident response team. See Malware & your website explained for how the two compare.

Restoring from a backup

Whether you can restore at all depends on your platform:

Squarespace: there is no backup to restore from. Deleted pages and blog posts come back for 30 days; everything else is fixed by hand.
Shopify: there is no self-serve way to roll your store back. CSV exports or a backup app are what you have.
Webflow and Wix: you can restore an earlier version, with limits. Check your platform's tab under By platform before you do.
Custom-coded: your developer can put an earlier deploy back live, but that doesn't roll back your data or settings.

On WordPress, if the damage is extensive, restoring from a clean backup is often faster than cleaning individual files.

Identify the last clean backup. This should be from before the hack started, not necessarily before you noticed it. A hack can go unnoticed for some time before it's detected. To estimate when it started, look at when unusual files appeared, when your traffic changed, or when the first complaints came in.

Restore the backup to a staging environment first. Don't restore directly to the live site until you've verified the restored version is actually clean. Your hosting provider can help with this.

Scan the restored site for malware before going live. A backup made after the attacker gained access may contain infected files.

Restore to the live site once the staging version is confirmed clean. See restoring your site from a backup.

First week: hardening after recovery

Once the site is clean and live, these steps prevent a repeat.

Update what you're responsible for. On WordPress, core, all plugins, and your theme should all be on their latest versions. Deactivate and delete any plugins or themes you are not actively using. See WordPress updates explained. On Shopify, check whether your Theme Store theme has an update, and uninstall apps you don't use. On Squarespace, Webflow and Wix, the platform runs its own software. On a custom-coded site, ask your developer to bring the site's code up to date.

Change every password again. Now that the site is confirmed clean, change every access point, not just the website login. On WordPress, that means every WordPress admin account, your hosting account, FTP/SFTP if you use it, and the database password (your host or developer can help). On a hosted platform, it means your platform account and your email, plus the services connected to your site, such as your domain provider and payment accounts. On a custom-coded site, it means your hosting account, the account where your code is stored, and any key that may have been exposed. If your email was involved, check again for forwarding rules or access grants you didn't create.

Review every user account. In WordPress, go to Users → All Users. On other platforms, check your contributors, staff or collaborators. Check with us before removing any, since our access, if you've given us some, is one of them. Delete any account you didn't create, and lower the access of any that has more than it needs.

Enable two-factor authentication on every account that can change your site. On Shopify, it's required if you use Shopify Payments. See two-factor authentication and, for WordPress, turning on two-factor login.

On WordPress, install a security plugin (if you don't have one). Wordfence, for example, adds a firewall and a malware scanner. See malware and your website for how the options compare, and securing your WordPress site. You can't install plugins on Squarespace, and on Shopify every extra app is another set of permissions to review.

Keep a copy you can get back. On WordPress, enable automated daily backups if you weren't already running them. Weekly backups may mean losing seven days of content in a worst-case scenario. On Squarespace, keep your own copies of your text, images and custom code. On Shopify, export your store data regularly or use a backup app. On Webflow, save a backup by hand before big changes. On Wix, you can duplicate your site as a manual copy. See how backups work.

Request a Google review if Google flagged your site. See Clearing a Google warning below.

Review where your themes and plugins came from. On WordPress, nulled (pirated) plugins and themes frequently contain malware. Remove any software that wasn't purchased from a legitimate source. On Shopify, updates aren't supported for themes bought outside the Shopify Theme Store.

Write a brief incident record. Document what happened, when, how you found it, what the likely cause was, and what you've changed. This is useful for your team, for insurance, and for future reference.

Clearing a Google warning

If Google flagged your site, affected pages can appear with a warning label in search results, or visitors can hit a warning page in their browser. Once the site is clean, request a review. These steps are the same on every platform:

Log in to Google Search Console for your site.

Open the Security issues report. It lists what Google found, with sample affected URLs.

Fix every issue listed, across the whole site. Google says fixing only some pages will not earn a partial return to search results.

Request a review. Select Request Review in the Security issues report, and describe what the problem was, what you did about it, and the result.

Then wait. Google says most reconsideration reviews take several days or weeks, and emails you when the review is done. Don't resubmit while a request is still open, as that can slow things down further.

What we do to help

When you contact us after a hack, here is what we do:

Triage and assessWe look at the site and identify what happened and the likely entry point, with your help on a hosted platform, since the login and activity logs belong to your account.
Clean upOn WordPress, we remove all infected files, database injections, and backdoors. On a hosted platform, we help you lock down the account and remove code, apps and users that shouldn't be there.
Restore from backup if needed and if your platform allows it, with staging verification on WordPress.
Update and hardenWe update what can be updated on your platform and apply security best practices.
Monitor for 30 daysOn WordPress sites, we watch for any signs of re-infection. This monitoring covers WordPress sites only at this time.
Communicate with you at every step so you're never in the dark.

Common questions

How did this happen to me? I thought my site was secure.

On WordPress, one of the most common causes is an outdated plugin with a known security vulnerability; stolen or guessed passwords are the other. Attackers run automated tools looking for vulnerable plugin versions: usually it's not a targeted attack on your business. It's more like a car thief trying every door handle in a parking lot. Keeping software updated is one of the most effective ways to prevent it. On Squarespace, Shopify, Webflow and Wix, the platform runs and secures its own software. Their own security advice focuses on your login (passwords, two-factor, who has access) and on third-party code or apps added to the site.

Do I need to tell my customers?

It depends on what data was accessible. If your site stored customer names, emails, payment details, or other personal information, you may have a legal obligation to notify those customers and possibly regulatory authorities. Consult a lawyer to understand your obligations in your region.

Will my Google rankings recover?

Usually, once the site is clean. If Google flagged the site, you need to fix every issue in the Security issues report and request a review; Google says most reviews take several days or weeks, and emails you when it's done. Rankings can take longer to settle as Google re-crawls your clean site.

My hosting company suspended my account. What do I do?

Contact your hosting provider's support team. Explain that you're cleaning the site, ask them for details of what they found, and ask what they need to see before they'll reinstate the account. Many hosts will walk you through recovery or point you to their recommended cleanup process.

On Squarespace, Shopify, Webflow and Wix, the platform is your host, so contact its support. Shopify asks you to contact Shopify Support immediately if you think your account was compromised, and Webflow asks you to notify it immediately.

Could my visitors' computers have been infected?

Some hacks deliver malware to visitors. If your site was injecting malicious code into visitor browsers, visitors should be advised to run a reputable antivirus scan. Be transparent: a brief note on your social media or email list is worth the short-term awkwardness.

How long does a full cleanup take?

A straightforward cleanup takes a few hours to one day. Complex infections with multiple backdoors or a compromised database can take two to three days. We'll give you an honest estimate once we've assessed the site. On WordPress, with a clean backup, a restore often takes a few hours. On Squarespace there is no backup to roll back to, and Shopify has no built-in one (only your own exports or a backup app), so changed content often has to be put right by hand, which takes longer the more was changed. If you use another cleanup service, ask for their turnaround before you sign up. If Google flagged the site, add the review on top: Google says most reviews take several days or weeks.

Will this happen again?

It can, if the root cause isn't fixed. The most important prevention steps: keep anything you're responsible for up to date, use strong unique passwords, turn on two-factor authentication, and keep a copy of your site you can get back. See Securing your WordPress site and two-factor authentication.

When to call a pro

Cleaning a hacked site only works if you find how the attacker got in. Miss the back door and the site is often reinfected within days, and Google can flag it as dangerous to visitors in the meantime.

If any of that sounds risky for your business, book a free call and we'll tell you whether you need help. Clients can email support@chykalophia.com.