Website hacked? First steps for a small business

When it breaks 5 min read

What to do when your website shows pages you did not write, in what order, and how to decide between having it cleaned and starting again.

Somebody sends you a screenshot of your own website advertising something you have never sold. Or you search for your business and Google puts a warning under your name. Or your site loads for a second and then throws the visitor onto a page in another language entirely.

It is an unpleasant thing to look at, and the instinct is to feel foolish. You have no reason to, because this is almost always done by software rather than by a person.

Work out what you are actually looking at

Three different problems look identical from the pavement, and they have different fixes.

Your website is serving pages you did not write. Extra pages, a changed homepage, or a redirect that sends visitors somewhere else. This is the site itself.

Your Google listing has been altered. The website is untouched but the name, the phone number or the website link on your Google Business Profile has been changed. That is claimed and fixed inside Google, and the site does not need touching.

Somebody built a copy of you elsewhere. Your name and photographs on an address that is not yours. Nothing of yours is broken, and this is a reporting job rather than a repair.

Check the actual address in the bar before doing anything else. It tells you which of the three you have, and the first is the only one that involves your hosting.

Take it down rather than leave it up

The instinct is to get it fixed and keep it live in the meantime. Reverse that. Call your host and ask them to take the site offline, or put a holding page up in its place.

Two reasons. A site serving harmful pages accumulates damage every hour it stays up, in warnings, in blocklists, and in whatever it is doing to visitors. And a compromised site is often being used to send spam or attack other people, which is a bigger problem for you than the page you can see.

A single page with your name, your number and a line saying the website is being rebuilt is a perfectly respectable thing for a customer to land on.

Change the passwords in the right order

Order matters here, because changing them in the wrong sequence lets an attacker reset the ones you just changed.

Start with the email account, because everything else resets through it. Then the domain registrar, because that controls where your name points. Then the hosting account. Then the website's own login, and any other accounts that share a password with any of these.

Turn on two-step verification on the email account and the registrar at the same time. If it is offered anywhere in the chain, that is where it earns its keep.

Why this happened, and it was not carelessness

Small business sites are rarely targeted by a person. They are found by software that walks the internet looking for one specific known weakness and tries it on everything it meets.

That weakness is almost always something out of date. A plugin nobody has updated since it was installed, a version of the site software two years behind, an old add-on whose author stopped maintaining it. Software ages, and a site that nobody has touched in three years has been getting slowly more vulnerable that whole time without a single visible sign.

Nobody told you this. The site was handed over working, and working is what it looked like right up until the morning it did not.

Cleaning it against starting again

This decision is worth taking twenty minutes over.

Cleaning is right when there is a recent, clean backup from before the problem started, and when somebody competent can restore it and update everything the same day. Restoring a good backup is quick.

Starting again is often the honest answer when the site is years old, nobody knows what is installed on it, there is no backup you trust, or the same thing has happened before. Cleaning a site that nobody understands is open-ended work, and the cleaned result is the same aging site it was last week, still carrying whatever let the software in.

If you are given a quote to clean, ask one question: what will stop it happening again. If the answer is only that they will remove the bad files, you are paying for a pause rather than a fix.

Get the warning removed once it is genuinely clean

If Google put a warning under your name, that warning does not lift on its own the moment the site is fixed. You have to ask for a review.

Do it through Google Search Console, which is free and which you may already have access to. There is a security issues section that names what was found and a button to request a review once you have dealt with it. Ask for the review only when the site is actually clean, because a failed review costs you time.

Check your listing and your site again a few days later. This is a step that gets forgotten in the relief of having a working website back.

A short checklist

• Check the address in the bar to confirm it is your site and not a copy
• Ask your host to take the site offline or serve a holding page
• Put your name and phone number on that holding page
• Change passwords in order: email, registrar, host, then the site itself
• Turn on two-step verification for email and registrar
• Ask the host what their logs show and when the change first appeared
• Decide honestly between restoring a trusted backup and rebuilding
• Request a review in Google Search Console once it is clean, then check again later

Questions people ask

How do I know if my website has been hacked

Pages you did not write, a redirect to somewhere else, a warning from Google, or your host emailing about unusual activity. Searching your own business name often shows it faster than looking at the homepage.

Should I take my website offline while it is being fixed

Yes. A holding page with your phone number does less damage than a live site serving pages you did not put there.

Will my customers know

Some may have seen a warning. If your site only ever emailed you inquiries, there was nothing stored to lose, but if it took payments or held customer accounts, get proper advice about what you have to tell people.

Is it cheaper to clean it or rebuild it

It depends entirely on whether there is a backup you trust and whether anybody understands what is installed. Cleaning a site nobody understands is open-ended, and rebuilding at least gives you a known starting point.

How do I get the Google warning removed

Fix the site first, then request a review in Google Search Console. Requesting it before the site is clean just adds a wait.

How do I stop it happening again

Keep the site software and its add-ons updated, keep backups you have actually tested restoring, and remove anything installed that you do not use.