Independent analysis. This page may contain affiliate links.
How to Recover a Hacked Website: A Step-by-Step Guide
Discovering that your site has been hacked is stressful, but recovery follows a fairly predictable sequence. The priority is containment first, cleanup second, and prevention third, in that order.
This guide walks through the steps most hosts and security teams recommend, from spotting the signs to getting removed from search warnings and hardening the site against the next attempt.
Quick comparison table
| Option | Best for | Starting price |
|---|---|---|
| Wordfence | WordPress scanning and firewall | Free; Premium paid |
| Sucuri | Malware removal and site firewall | Paid plans |
| Google Search Console | Checking for security warnings | Free |
| Cloudflare | DDoS protection and web firewall | Free tier available |
| UpdraftPlus | Backups for a quick restore | Free tier; paid plans |
| Have I Been Pwned | Checking for leaked credentials | Free |
Recognize the signs of a hack
Tell-tale signs include unexpected redirects, new administrator accounts you did not create, defaced pages, spam links appearing in search results, a sudden traffic drop, and security warnings from Google or your host.
Sometimes there are no visible symptoms. Malware can quietly serve spam or steal visitor data, so periodic scanning and monitoring matter even when the site looks fine.
Contain the damage immediately
Act fast to stop the spread. Take the site offline or put it in maintenance mode, change every admin, database, and hosting password, and rotate API keys and FTP or SSH credentials.
Check with your host about isolating the account. Many hosts offer a temporary lockdown that prevents further damage while you investigate the entry point.
Restore from a clean backup
If you have a backup from before the compromise, this is the fastest path. Verify the backup is genuinely clean, restore to a staging environment first, and confirm it is malware-free before pushing it live.
Rotate credentials after restoring, because the old passwords may have been the vector that let the attacker in. A clean backup restores files, not your trust in old secrets.
Clean the site if you have no backup
Without a backup, you have to find and remove the malicious code by hand or with a scanner. Start with a malware scanner to identify infected files, then compare suspicious files against fresh copies from a trusted source.
Pay close attention to themes, plugins, and core files, and to anything in upload directories that should not contain executable code. Reinstall plugins and themes from official sources rather than patching infected copies.
Update credentials and close the hole
The most common entry points are outdated software, weak or reused passwords, and insecure plugins. Update the CMS, themes, and plugins, remove anything you do not use, and enforce strong unique passwords with two-factor authentication.
Check for unauthorized accounts and scheduled tasks you did not create. If a plugin is abandoned or known to be vulnerable, replace it rather than waiting for a patch that may never come.
Remove warnings and request a review
If Google flagged the site, fix the issues first, then use Search Console to request a review. Remove any malicious links, spam pages, and cloaked content before you submit, or the request will be rejected.
If visitors saw malware or phishing pages, warn them. Depending on your jurisdiction and the data involved, you may also have legal notification obligations.
Harden against repeat attacks
Set up automated backups, keep an offline or offsite copy, and schedule scans. Add a web application firewall, limit login attempts, and monitor file changes.
Run updates promptly, and keep a simple incident log of what happened and how you fixed it. The goal is not just to recover but to make the site a harder target the next time.
Pros
- A disciplined sequence limits further damage
- A clean backup restores the site in minutes
- Search Console helps confirm the fix was accepted
- Hardening reduces the odds of a repeat incident
Cons
- Delaying containment lets the damage spread
- Incomplete cleanup can leave hidden backdoors
- Cleaning without fixing the entry point invites reinfection
Frequently asked questions
How do I know if my site is hacked?
Common signs include unexpected redirects, new admin users you did not create, defaced pages, spam links in search results, sudden traffic drops, or a security warning in Google Search Console.
Should I delete everything and start over?
Only as a last resort. If you have a verified clean backup from before the compromise, restoring it is faster and safer. Full rebuilds are usually reserved for cases where the infection cannot be reliably cleaned.
How long does recovery take?
With a clean backup, recovery can take under an hour. Manual cleanup of a deeply infected site can take days, and Google review can add more time after you fix the issues and submit a request.
Do I need to tell my visitors?
If personal data was exposed, you may have legal notification obligations depending on your jurisdiction. At minimum, warn users if the site was serving malware or phishing pages.
Verdict
Recovery rewards order and speed: contain, restore or clean, then fix the entry point before you reopen. A good backup and current software turn a catastrophe into an inconvenience. If the site cannot be cleaned with confidence, a careful rebuild is the honest answer.
Read more: security plugin · back up a website.