Defaced pages, spam redirects, a Google warning, a suspended hosting account: your site has been hacked. The first hours matter.
Hour 0–1: contain
Do not delete anything; put the site in maintenance mode; alert your host; copy files, database and logs as they are.
Hour 1–4: cut the attacker’s access
Change every password (admin, hosting, SFTP, database, email), remove unknown admin accounts, rotate API keys, review provider access.
Hour 4–12: understand and clean
Find the entry point (outdated plugin, weak password, compromised account). Restore a pre-intrusion backup, update everything and close the hole — or reinstall from official sources and clean.
Hour 12–24: relaunch and report
Bring the site back, request a Search Console review, check blacklists. If personal data may have been exposed, the GDPR requires notifying the supervisory authority (the CNIL in France) within 72 hours when there is a risk to individuals.
A hacked site is not fixed when it works again, but when you know how the attacker got in — and that door is closed.
Prevent a repeat
Tested updates, off-site backups, 2FA, fewer plugins, file integrity monitoring — see the WordPress checklist and maintenance contracts.
Hacked website: FAQ
How do I know my site was hacked?
Unknown pages or links, redirects, Google or browser warnings, unknown admin accounts, sudden slowness.
Does Google penalise hacked sites?
It can warn users and drop pages; request a review in Search Console once cleaned.
Need help now?
Our website maintenance team in Paris handles hacked sites end to end. Contact us.