My website has been hacked: what to do in the first hour

Step 1Don't delete anything yet

The first urge is to delete the strange pages, wipe the site or put last month's backup back. Hold off. Deleting files destroys the trail that shows how they got in, and an old backup still has the same way in, so the same thing can happen again.

Write down what you saw, where and when, and take screenshots. If visitors are being sent to another site, or a browser shows a warning before your site opens, ask your hosting company to take the site offline while you work. A short time offline does less harm than customers landing somewhere you would never send them.

Step 2Take a copy of the site as it is

Before anything changes, take a full copy of the site: its files and its database. Most hosting control panels have a backup button, and your hosting company can usually make the copy for you. Name it plainly, for example “hacked copy, 23 October”, and keep it apart from your clean backups so nobody puts it back by mistake.

That copy is your evidence, and whoever cleans the site will want to see it. On a hosted builder such as Wix or Squarespace you can't take this kind of copy, so go straight to step 3.

Step 3Change every password, and remove logins you don't recognise

Assume every password connected to the site is known. Change them from a computer you trust, and start with your email, because whoever controls the inbox that receives the site's password resets can reset everything else.

1. Your email: the account the website and the hosting send their reset emails to.
2. The website's admin login, and every other account that can log in to it.
3. Your hosting control panel, and any FTP or SFTP accounts.
4. The database password. Your host or developer can change it; the site's settings file needs the new one too.
5. Your domain registrar, where your web address is registered.

Then open the list of users in the site's admin and remove anyone you don't recognise, administrators first. If you use Google Search Console, check its users too and remove any owner you didn't add. Turn on two-step login wherever it's offered.

On WordPress, ask whoever looks after the site to change the security keys in its settings file. That signs everyone out at once, including anyone using a stolen login.

Step 4Update the software

Out-of-date software is one of the commonest ways in: the website platform itself, a plugin or a theme. Update all three, then delete every plugin and theme you don't use. A switched-off plugin can still be broken into while its files sit on the server.

If the site is years behind, an update can break it. That's the moment to get help, not a reason to leave it as it is.

Step 5Find what was added

Now look for anything you didn't make. Some of it is built to stay out of your sight, so look the way a stranger and a search engine would.

• Pages you never published. Go through every page and post in the admin, newest first.
• Text and links you didn't write. Open your home page's source (Ctrl+U in Chrome on Windows, Option+Cmd+U on a Mac) and search it for words like casino, loan or viagra.
• Files changed recently. Your hosting company can list the files changed in the last few weeks. On WordPress, a .php file in the uploads folder, which should only hold your pictures and documents, is a bad sign.
• What Google holds. Search Google for site:yourdomain.co.uk, with your own domain, and look for titles you don't recognise, in English or any other language.
• Search Console's Security issues report, if your site is set up in Search Console. It says what Google found, and where.

Our guide to the signs of a hacked WordPress site goes through each of these in more detail.

Step 6Once it's clean, ask Google to look again

Only when the site is clean and updated, tell Google. In Search Console, open the Security issues report. If it lists a problem, ask for a review, and say in plain words what you found and what you fixed. If Chrome has been showing a red warning in front of your site, this is how it comes off.

Ask only when the work is done, because Google checks the site before it takes a warning away. If spam pages still show in Google's results after the site is clean, our guide to spam pages explains how to get them out.

When to get help

Get help the same day if any of these is true.

• The spam comes back after you've removed it, which means the way in is still open.
• You can't get into the site's admin or the hosting.
• A browser warns people away from your site.
• Your site takes card payments. Tell your payment provider today as well.
• Nobody knows who built the site, or its software is years out of date.

Our Emergency Clean-Up is £495, one fixed price. We remove the injected spam, the hidden pages and the malicious code, close the logins that were left open, and hand you a report that proves the site is clean, within 48 hours of getting access. If a site can't be made safe, we say so plainly and quote a Secure Rebuild, and the £495 comes off it.

Not sure it has been hacked at all? The free check reads only what any visitor and a search engine can see, with no sign-up and no change to your site, and shows you the proof in seconds.