Website Hacked? What to Do in the First Hour

You search your business name and Google shows a warning. Or a customer tells you your website sent them to a strange page. It is a sinking feeling, and it happens to small businesses every day.

The good news is that you can usually clean a hacked website and get it back to normal quickly. What you do in the first hour makes the biggest difference. This guide walks you through it, step by step.

Signs your website has been hacked

• A warning in Google or the browser, such as “This site may be hacked” or a red security screen.
• Strange redirects. The site sends visitors, often on phones, to spam, betting or pharmacy websites.
• Pages you did not create, sometimes in another language, showing up in Google.
• New admin users in WordPress that nobody on your team added.
• Emails from your host or Google about malware or unusual activity.
• A sudden traffic drop or your site loading very slowly.

What to do in the first hour after your website is hacked

1. Stay calm and do not delete anything

Of course, it is tempting to wipe the site and start again. However, it is better to hold off. The hacked files show how the attacker got in, and you may need your content. Deleting things in a hurry often makes the cleanup longer.

2. Change every password

Change the passwords for your hosting account, every WordPress admin user, your FTP or file manager login and your domain account. Use long, unique passwords and also turn on two-step login wherever your accounts offer it.

3. Check for users you do not recognise

In WordPress, go to Users and look for accounts with the Administrator role that nobody on your team created. Note their names and dates, then remove them once you have a backup.

4. Take a backup of the hacked site

Next, before you change anything else, ask your host for a full backup, or download one yourself. This protects your content and gives whoever cleans the site a copy to investigate.

5. Contact your hosting company

First, your host can tell you when the problem started, scan the server and check whether other websites on the same account are affected. Many hosts also have backups from before the hack.

6. Check Google Search Console

Open the Security issues report in Google Search Console. It lists the problems Google found, as well as example pages. You will use the same report to ask for a review once the site is clean.

How to clean and secure the site

After the first hour, your goal is to remove every trace of the hack and close the gap that let it in.

• Restore a clean backup from before the hack, if you have one, or clean the infected files.
• Update WordPress, your theme and every plugin, and remove anything you do not use.
• Replace security keys in your WordPress settings so old logins stop working.
• Scan the site again to confirm nothing was missed.
• Request a review in Search Console so Google removes the warning.

If the hack broke your site and you now see “There has been a critical error on this website”, our guide on how to fix a WordPress critical error explains what that message means.

When to call a professional

A hacked website affects your customers, your rankings and your reputation. Get help if the hack keeps coming back, if Google shows a warning, if the hack could affect customer data, or if you need the site working again today.

Our emergency website repair team cleans hacked WordPress sites, closes the gap that let the hacker in and helps you ask Google to remove the warning. We finish most jobs within 3 to 5 hours, 7 days a week, and you get a clear quote before we start.

How to stop it happening again

• Keep WordPress, your theme and plugins updated
• Use strong passwords and two-step login
• Remove admin accounts nobody uses
• Keep daily backups stored away from your hosting
• Use a security scanner and an uptime monitor

If your site is old and keeps getting hacked, a fresh, secure build can be cheaper than repeated cleanups. See our website design service, or our same day website design if you need a clean one-page site live in 4 hours. If the hack hurt your reviews or reputation, our review and reputation management can help you rebuild trust.

Frequently asked questions

How do I know if my website was hacked?

Common signs are a warning in Google or your browser, pages or links you did not create, visitors being sent to other websites, new admin users you do not recognise, or a sudden drop in traffic. Your host or Google Search Console may also email you.

Should I delete my hacked website and start again?

Usually not. In fact, deleting removes evidence of how the hacker got in, and you may lose content you need. Cleaning the site and closing the gap is faster and safer in most cases.

How long does it take to clean a hacked website?

We can often clean a simple hack within a few hours. A deep malware infection, or one that spread across several sites on the same hosting, can take longer.

Will Google remove the hacked warning automatically?

Once your site is clean, you can ask Google to review it in Search Console. Google checks the site again, and then removes the warning once the review passes.

Quick Leadz Marketing is a digital marketing agency based in Surrey, BC. We build, fix and secure WordPress websites for small businesses across Canada.

Security advice changes over time. This article reflects Google’s Search Console help centre as of November 2026. If the hack may affect customer data, speak with a professional as soon as possible.