In this article
How to tell if you’ve really been hacked
The most common signs we see every week on the sites we clean up:
- The site redirects to unknown pages, especially from smartphones or when clicking from Google results;
- searching your domain on Google brings up pages in other languages or about products you don’t sell;
- the browser shows the red “deceptive site” or “compromised site” warning;
- company emails land in spam or are rejected;
- your host flags malware or mass email sending from your space.
| Situation | Do this | Do not do this |
|---|---|---|
| As soon as you notice | Change hosting, FTP, database and admin passwords — from a clean device | Do not delete suspicious files: they are clues to the point of entry |
| The infected files | Write everything down: when it happened, what you saw, what you touched | Do not delete blindly: you would almost certainly leave a back door open |
| The backup | Check it predates the intrusion, and that the hole is closed | Do not just restore: if the backup is later, you restore the malware too |
| Security plugins | Have the site analysed by someone who can find active back doors | Do not install three at random: they do not remove what is already inside |
| The problem itself | Deal with it now: Google flags compromised sites and traffic collapses | Do not ignore it hoping it passes: it gets worse, and each day costs more |
| After the clean-up | Regular updates, firewall, off-server backups, monitoring | Do not assume it is over: without prevention you get hit again within days |
What to do right now
- Don’t delete anything. Suspicious files and logs are valuable clues for finding the entry point: deleting them blindly almost always leaves a back door open.
- Change the passwords for hosting, FTP, database and admin — from a clean device.
- Note everything: when you noticed the symptoms, what you changed recently, which plugins you installed.
- Have the site analysed by professionals. A serious clean-up covers files and database: malware, rogue admin users and backdoors hidden in the most unlikely places.
Site breached or under attack?
For emergencies we act the same day, with malware removal and recovery. Write to us now.
Get help nowWhat NOT to do
Don’t just restore a backup: if the backup is later than the intrusion, you restore the malware too; and if the hole stays open, you’ll be breached again within days. Don’t install three random security plugins: they don’t remove backdoors that are already active. And don’t ignore the problem because “the site still loads”: every day of compromise worsens the domain’s reputation on Google and the delivery of your emails. It’s worth remembering that, faced with a hacked site, haste is a bad adviser: improvised moves — restoring at random, deleting files, installing random tools — often make things worse or destroy the traces needed to understand how they got in. Better to stop, secure access and rely on someone who knows where to look.
Free audit. If you suspect a compromise, request our free audit: we analyse the site and tell you what was hit, how serious it is and what’s needed to clean it up. In most cases the site is back online in 24–48 hours.
After the clean-up: never again
Removing the malware is half the job; the other half is making sure it doesn’t happen again: regular updates, an application firewall, off-server backups and monitoring. It’s exactly what our maintenance plans cover — at a fraction of the cost of a single emergency. It’s the same difference as between fitting an alarm and calling for help after a burglary: prevention costs little and works quietly, while chasing an emergency costs far more, in money and in days of downtime. Regular updates, an application firewall, backups kept off the server and monitoring that flags anomalies drastically reduce the chance of ending up back at square one, and let you sleep more soundly.