What to Do If Your Business Website Gets Hacked

A hacked website is stressful because the first signs are often public: strange redirects, spam pages, browser warnings, broken forms, or customers saying something looks wrong. The worst response is panic-clicking until the obvious symptom disappears. Contain the damage first, then find the cause and bring the site back from clean sources. Google also publishes a technical recovery guide for site owners, Help, I think I've been hacked, which goes deeper into the cleanup itself.

First, contain the problem

If the site is redirecting visitors, showing malware warnings, taking payments incorrectly, or exposing private information, take it offline or put it into maintenance mode until it can be checked. A short outage is better than sending customers into a compromised site. If the issue is limited to defacement or spam pages, you may still need to restrict admin access while investigating.

Leave the infected files where they are for now. Whoever cleans the site needs them to trace the entry point.

Change the right passwords

Change them from a device you trust, and turn on two-factor authentication for each account as you go.

• Website admin accounts.
• Hosting control panel.
• FTP, SFTP, SSH, or deployment accounts.
• Database account where relevant.
• Business email accounts tied to website admin or password resets.
• Domain registrar and DNS accounts.
• Connected tools such as payment, booking, CRM, or forms if they may be affected.

Remove access the attacker added

Attackers rarely rely on a single way back in. Check each of these, because any one left behind can let them return after the cleanup:

• Admin users on the website that nobody at your business created.
• Owners and users in Google Search Console, checked property by property, and the file or DNS record that verified each owner nobody at your business can account for.
• Extra FTP, SSH, or database users in your hosting control panel.
• Scheduled tasks (cron jobs) that download or rewrite files.
• Forwarding rules and filters on the mailboxes tied to the site.
• Sitemap lines in robots.txt that point to sitemaps you did not create.

Find the entry point

Cleaning the visible spam leaves the problem in place. The attacker may have entered through an outdated plugin, weak password, reused admin login, abandoned user account, insecure form, old theme, compromised email, or vulnerable hosting setup. If that door stays open, the site can be infected again within days.

Check every site on the same hosting account as well as the one that looks broken. On shared hosting, the sites on one account usually run as the same user, so an attacker in one can often reach the others. Sites left running after a redesign or a finished project are a common way in. List everything the account holds, including test copies and apps you forgot were there. We have seen the obvious infection sit in one site while the same account also held an older web application with a published critical vulnerability that nobody was maintaining.

Check what Google sees

Some attacks show spam only to Google while the site looks normal to you and your customers. To see what Google has stored, run a site: search for your domain, open the Security issues report in Google Search Console, and use View crawled page in the URL Inspection tool. The guide to spam pages that only Google sees walks through each check.

Treat the first scan as a starting point

Malware scanners, including the ones hosting companies run, catch known patterns, and attackers disguise their files to look like ordinary website files. Files that survived a scan and a staging copy made from an already infected site have both turned up in our cleanups. A first written report can also overstate and understate at once. In one cleanup, the first report called the backups clean with no record of checking them, and listed several empty files as live backdoors. A second, independent check tested the backups properly and changed the recovery plan.

Rebuild from clean sources when you move hosts

A full account backup or copy carries the attacker's files across with everything else. Rebuild from official copies of the software, a database you have checked for injected code and unknown admin users, and uploads you have verified. Then point the domain at the new site.

Check for customer risk

If the site handles payments, bookings, uploads, client records, health information, or private messages, treat the incident more seriously. Find out what data the site stores, whether it was accessed, and whether connected services were affected. This is where professional security help is worth it, because the risk extends past the website to customer trust.

Guyana's Data Protection Act 2023 sets the rules to plan for. It had not been brought into force at the last public confirmation, in May 2026. Once it is, section 65 requires a business to report a personal data breach to the Data Protection Commissioner without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put anyone at risk. Under section 66, people facing a high risk from the breach must be told on the same timetable, unless an exception applies, such as the data being encrypted. The guide to customer data privacy covers the rest of the Act.

Close old hosting properly

When the cleanup ends with closing an old hosting account, list what still depends on it first: email, other sites, and DNS records. After it closes, remove the old mail and DNS records, and publish SPF and DMARC records so mail sent from the old server is treated as unauthorised. An account you have stopped paying for still needs closing: expired hosting can go on accepting logins, and the longest-running backdoor we have found had sat on an account like that for about two years.

After the site is clean

1. Patch the software, plugins, themes, and server configuration involved.
2. Remove unused admin accounts, plugins, themes, and old files.
3. Turn on two-factor authentication where possible.
4. Set up automated backups and uptime/security monitoring.
5. Request a review in Search Console's Security issues report if Google flagged the site.
6. Monitor forms, redirects, and search results for a few weeks.

Prevention is cheaper than cleanup

Most small-business website hacks are automated scans looking for weak passwords, old software, and neglected sites, and they are rarely personal. A maintenance plan with updates, backups, monitoring, and account hardening is usually cheaper than emergency cleanup. Start with cybersecurity basics and website maintenance planning.