I think I was hacked

Discovering, or even suspecting, a hack is alarming. Your instinct might be to start changing things immediately, but acting in the right order matters. This guide covers the first hour: how to contain the damage and get help. For the full clean-up, restore and hardening process, see Recovering from a hacked website.

This needs urgent attention

If you believe your site or accounts are actively compromised, email support@chykalophia.com with "URGENT: Possible hack" in the subject line and your site URL. We'll prioritize your case.

Signs your site may have been hacked

Not sure if it's actually a hack? Look for these warning signs:

Your site shows up in Google's search results with a warning label, or your browser shows a warning page before it will open the site
Visitors are being redirected to a different, unrelated website
New pages, posts, or users appeared that you didn't create
Your site is sending spam emails without your knowledge
Your hosting provider suspended your account for malicious activity
You see strange code or gibberish text in your content
Your site has been defaced (replaced with different imagery or messages)
Your admin password no longer works

Troubleshooter

What should you do first?

Do you see any of the signs above?

Step 1: Don't panic, and don't delete anything yet

Stop what you're doing. Don't start deleting files or changing things without guidance.

Take screenshots of everything unusual: error messages, strange content, unfamiliar admin users, anything out of the ordinary.

Write down when you first noticed the issue and what you were doing at the time.

Preserving evidence helps us understand how the breach happened, which is essential for preventing a recurrence.

Step 2: Change your passwords immediately

Start with your email: whoever controls the email address you log in with can reset your other passwords. Use a different device or network if possible.

Change your email account password first: especially if you use the same email for your website and financial accounts. While you're in your email, check for forwarding rules or access grants you didn't create.

Change your website login password. What that means depends on your setup:

WordPress: change your WordPress admin password, then your hosting account password.
Squarespace, Shopify, Webflow or Wix: your platform account is your site, so change that account's password, then sign out other sessions where your platform offers it.
Custom-coded: change the passwords for your hosting account and the account where your site's code is stored.

Locked out? If you can't log in because someone changed your password or login email, start your platform's account recovery straight away (see I can't log in). If you can't get into your email either, recover it with your email provider first. On a WordPress site we look after, contact us.

Change your domain registrar password.

Enable two-factor authentication on every account that supports it. See setting up two-factor authentication.

Use a different device to change passwords

If your usual computer may be compromised, use your phone or a different computer to change passwords. This prevents a keylogger (software that records keystrokes) from capturing your new passwords.

Step 3: Contact us

Your site URL
What you noticed and when
Any screenshots of unusual activity
What you've already changed

We'll take it from there: scanning, cleanup, restoring from a clean backup where your platform has one, and hardening. Recovering from a hacked website walks through each stage.

Step 4: Check other accounts

A compromised site often signals a wider problem. Check:

Were your email credentials used anywhere else? If you reuse passwords, every account with the same password is at risk.
Are any financial accounts linked to the compromised email address?
Check your email's sent folder for emails you didn't send.
Check your bank and payment accounts for unauthorized transactions.

Step 5: Notify affected parties if needed

If customer data may have been exposed:

Make a list of what data your site stores. Customer names, emails, addresses, order history?

Consult a legal or compliance advisor if personal data was likely accessed. Depending on your region and industry, you may have legal obligations to notify affected individuals.

Data breach regulations

Many countries and US states have laws requiring businesses to notify customers after a data breach, and the deadlines and thresholds differ from place to place. This is general information, not legal advice. Contact a legal advisor if you're unsure of your obligations.

Common questions

My site looks fine to me but visitors say they're being redirected.

Hackers often set redirects that only affect visitors who aren't logged in, or who arrive from search engines. This makes the site look normal to you while redirecting everyone else. This is a classic sign of a redirect-based hack.

An unknown admin user appeared in my WordPress dashboard.

This is a serious sign of compromise. Do not delete the user yet: note their username and email address, then contact us. We need to investigate how they got in before removing them.

My hosting was suspended for 'malicious activity.' Is that a hack?

Not always: it could be a script running incorrectly, a plugin sending spam, or actual malware. Either way, it needs investigation before the account can be reactivated. Contact us and we'll work with your host.

I cleaned the malware but it keeps coming back.

This happens when the attackers left a backdoor: a hidden entry point they can use to re-infect the site. Simply removing visible malware isn't enough. A thorough forensic cleanup is needed. Contact us.

When to call a pro

Cleaning a hacked site only works if you find how the attacker got in. Miss the back door and the site is often reinfected within days, and Google can flag it as dangerous to visitors in the meantime.

If any of that sounds risky for your business, book a free call and we'll tell you whether you need help. Clients can email support@chykalophia.com.