Maybe Google flagged your site with a “this site may be hacked” warning. Maybe a customer called to say your homepage is redirecting somewhere strange. Maybe your hosting company suspended your account, or you found pages on your site you never wrote, in a language you don’t speak.
However you found out, take a breath. A hacked website is recoverable, and the businesses that come out of it fine are the ones that act methodically in the first day or two rather than panicking or ignoring it. Here’s exactly what to do, in order.
Signs Your Website Has Been Hacked
Sometimes it’s obvious - defacement, redirects to gambling or pharmaceutical sites, ransom messages. But most compromises are deliberately quiet. The attacker wants to use your site, not announce themselves. Watch for:
- Google Search Console warnings about hacked content, social engineering, or malware
- A “Deceptive site ahead” warning in Chrome when visitors open your site
- New pages or spammy links appearing in Google when you search
site:yourdomain.com.au - Your emails suddenly bouncing or landing in spam - a compromised server often gets blacklisted
- Unexplained traffic spikes to pages you didn’t create, or a sudden rankings collapse
- New admin users in your CMS you didn’t add, or password reset emails you didn’t request
- Your hosting provider contacting you about malicious files or excessive resource usage
If you’re seeing any of these, assume compromise and keep going.
Step 1: Contain the Damage First
Before anything is cleaned or fixed, stop the site doing further harm to your visitors and your reputation:
- Take the site offline or enable maintenance mode. A holding page for a day costs you far less than a week of serving malware to customers.
- Change every password - hosting control panel, CMS admin, FTP, database, and your domain registrar. From a device you trust, not the possibly-compromised machine you always use.
- Tell your web provider immediately. If an agency or freelancer manages your site, this is their job - hand it over and let them run the steps below.
- Don’t delete anything yet. Logs and modified files are the evidence that tells you how the attacker got in. Delete them and you’ll clean the site without closing the door they used.
Step 2: Find and Remove the Compromise
This is the technical heart of website repair, and where most business owners should hand over to a professional. The process the Australian Cyber Security Centre recommends after this year’s mass exploitation campaign:
- Check the file system for anything new or modified - webshells and malware hide inside plugin folders, upload directories, and theme files
- Review access logs to find the initial break-in and any backdoors planted since
- Identify the vulnerability - on small business sites it’s almost always an outdated plugin, theme, or CMS core with a known, patched flaw
- Restore from a clean backup taken before the compromise, rather than trying to hand-clean infected files - attackers routinely leave multiple ways back in
- Patch the vulnerability before the site goes live again, or you’ll be re-hacked within days by the same automated scanners
That last point matters more than any other. Cleaning without patching isn’t repair, it’s rescheduling.
Step 3: Repair the Fallout
Once the site itself is clean:
- Request a review in Google Search Console if Google flagged the site - the “hacked” label usually lifts within a few days of a clean review
- Check blacklists for your domain and server IP (Spamhaus, Google Safe Browsing) and request delisting
- Notify affected customers if any personal data may have been accessed. Under Australia’s Notifiable Data Breaches scheme, businesses covered by the Privacy Act are legally required to report eligible breaches to the OAIC and the people affected
- Watch your rankings for a few weeks. Some dip is normal after a hack; sustained recovery follows once Google recrawls the clean site
What Does Hacked Website Repair Cost?
For a typical Australian small business site, professional hacked website repair runs from a few hundred dollars for a straightforward clean-and-restore to several thousand where there’s no usable backup, the compromise is extensive, or data was exposed. The Australian Signals Directorate’s latest figures put the average total cost of a cybercrime incident for a small business at $56,600 - a figure that includes downtime, lost business, and recovery, and rose 14 per cent in a year.
The comparison worth making: the repair bill for one incident is usually several years’ worth of the ongoing maintenance that would have prevented it.
How to Make Sure It Never Happens Again
Every recovery ends with the same question: how do we stop this recurring? In order of effectiveness:
- Remove the attack surface entirely. Most small business sites are brochure sites that don’t need a CMS, plugins, or a database. A static website has none of the machinery that gets hacked - no login page, no plugins to patch, no server-side code to exploit. It’s the only option on this list that eliminates the problem rather than managing it.
- If you stay on WordPress, maintain it properly. Updates applied within days, unused plugins deleted, tested backups. The 13,000 WordPress sites compromised daily are overwhelmingly running unmaintained plugins with known vulnerabilities.
- Harden the basics. Unique passwords in a password manager, multi-factor authentication on hosting and admin accounts, and daily off-site backups you’ve actually test-restored.
If your website has been hacked and you need it repaired - or you’d rather move to a setup that can’t be hacked this way in the first place - get in touch to find out how YourStuff can help.
Photo by Philipp Katzenberger on Unsplash
