My website was hacked: first steps

If your website has been hacked, work in this order: confirm what is happening, call your host or website provider, change your passwords from a clean device, restore a clean copy of the site, then ask Google to recheck it. Do not start deleting files or reinstalling things on your own in a panic; you can destroy the evidence of how they got in and the clean backup you need. Most hacked small business sites can be brought back. Here is what to do, step by step.

Signs it really is a hack

Some things look like a hack and are not. Before you act, check what you are seeing:

Visitors are sent to another website (pills, gambling, fake prize pages), especially when they arrive from Google or on a phone. That is a hack.
Google shows pages you never wrote when you search for your site's name. Try searching "site:" followed by your domain, for example site:yourbusiness.com, and scroll. Pages in another language or about products you do not sell are a classic sign.
The browser shows a red warning page saying the site may be dangerous. That is a hack or malware.
Your host emailed you about suspicious activity or suspended the account.
The site is simply down, with an error. That might be a hack, but it is more often an expired domain, an unpaid hosting bill or a broken update. Check those first.

Step 1: Write down what you see, then contain it

Take screenshots of what is wrong, with the date and time: the redirect, the warning, the strange search results. Note when you first noticed. This helps whoever cleans it up.

If the site is sending visitors to scams, the kind thing for your customers is to take it offline for a short while. Your host can usually put up a "maintenance" page or suspend the site. A day offline is better than a week of customers landing on a fake pharmacy under your name.

Step 2: Call your host or website provider

Your hosting company or website builder is the first call, not a random "malware removal" service you found in an ad.

On website builders such as Squarespace or Wix, the platform itself is rarely what was broken into; the usual cause is someone getting into your account. Their support team can tell you what changed and help you lock the account.
On hosting with WordPress or similar, ask the host: Do you see malware on my account? Do you have clean backups from before it started, and how far back? Can you restore one? Some hosts include a cleanup; others will recommend a specialist.
If a web designer or agency manages the site, call them now. Ask them the same questions, and ask that they do not reinstall anything before checking backups.

Step 3: Change passwords, from a clean device

If the break-in came through a stolen password, changing it from an infected computer can hand over the new one too. Use a device you trust, ideally a phone or a different computer, and change:

Your email password first, because password resets for everything else go there.
Your domain registrar password.
Your hosting or builder account password.
Every website login, including other users' accounts. Delete any user you do not recognize.
The database and file-transfer (FTP) passwords, if your host shows them. Your host can help with these.

Turn on two-step codes on every one of these as you go. And run a proper virus scan on the computer you normally use for the website.

Step 4: Restore a clean copy, or clean it properly

There are two ways back:

Restore from a clean backup. This is the fastest route, if you have a backup from before the hack. Pick one from well before you first noticed anything, because hacks often sit quietly for a while first. After restoring, you will need to redo any real changes made since that date.

Clean the site as it stands. If there is no clean backup, someone has to find and remove every changed file and hidden account. This is careful work and it is easy to miss a back door. It is worth paying a reputable specialist your host recommends.

Either way, the hole that let them in must be closed, or they come back. On WordPress that usually means updating everything and removing old plugins and themes.

Step 5: Tell Google it is clean

If Google has noticed, your site may carry a warning in search results or in browsers. To clear it:

Sign in to Google Search Console. If you have never set it up, add your site and verify it; your host or provider can help.
Open "Security issues" in the left menu. It lists what Google found, often with example pages.
Once the site is clean, press "Request review" and describe briefly what you fixed.

Google rechecks and, if satisfied, removes the warning. It can take from a day to a couple of weeks. Junk pages the hackers created will drop out of Google gradually once they return "not found". Spammy pages on a hacked website covers that cleanup in more detail.

Step 6: Check the quiet damage

Hacks sometimes touch more than the pages:

Your email. Check that your domain's email still arrives and that nobody added forwarding rules in your mailbox settings.
Your domain. Log in to the registrar and check the contact email and where the domain points have not been changed.
Your contact form. Send yourself a test message.
Customer data. If your site stored anything about customers, such as accounts, orders or form submissions, talk to your attorney about whether you have to tell anyone. Rules differ by state.

Should you rebuild instead?

If the site was old, full of plugins nobody updates and hacked more than once, cleaning it again may only buy you time. A rebuild on a simpler setup, with fewer parts to break into, can cost less over a year than repeated cleanups. When you go that way, keep your page addresses and get your text and photos out first; what to save before you replace your old website is a good checklist. Then the website security basics keep the new site out of trouble.

Your first-day checklist

Screenshots of the problem, with times.
Site taken offline if it is sending customers to scams.
Host, builder or web designer called.
Email, registrar, hosting and website passwords changed from a clean device, with two-step codes on.
Unknown users deleted.
Clean backup restored, or a specialist booked to clean it.
Software updated and the way in closed.
Review requested in Search Console.

If the old site is beyond saving, you can see your site rebuilt first from its pages and decide once it is live as a preview.