Website hacked? What to do now, and how to prevent it next time

1. How to tell if your website has been hacked

Some hacks are obvious. Others are built to hide from you while still harming visitors or your search results. Google notes that hacks are often invisible to the people using the site. Common signs include:

• A warning in Google or the browser: Google can show a warning label in search results, or a full warning page in the browser, when it finds a site is hacked or harmful.
• Strange pages in Google: search results for your site show pages you never made, often in another language or selling pills, loans or knock-off goods.
• Redirects: visitors, especially on phones or arriving from Google, are sent to another site.
• Logins that stop working, or new admin users you don't recognise.
• A message from your host saying your account was suspended or flagged for malware or spam.
• Odd emails sent from your domain, or customers saying they got a suspicious message from you.

Two quick checks. First, search Google for site: followed by your domain, for example site:yourbusiness.com.au. Google recommends this because it lists the pages it knows about, including pages a hacker may have added. Second, open the Security issues report in Google Search Console, which lists the problems Google has detected with example URLs. Some hacks use cloaking, showing spam to Google and a normal page to you, so a page that looks fine in your browser isn't proof the site is clean.

2. Website hacked: what to do first to contain it

The first job is to stop the damage spreading to your visitors and give yourself room to work. Google's guidance for hacked sites is to take the site offline while you fix it, for example by pointing your domain to a simple maintenance page on a different server that returns a 503 status ("temporarily unavailable").

• Put up a maintenance page served from outside the hacked site. Google warns that an error page coming from the compromised server can still deliver harmful content.
• Don't rely on robots.txt. Blocking search engines doesn't stop people reaching the infected pages.
• Don't panic about rankings. Google says taking a site offline temporarily during recovery is unlikely to affect how it ranks later.
• Contact your host straight away. Tell them what you've seen. They can often switch the site offline for you, check whether other sites on the same server were hit, and tell you what backups they hold.

If you're not sure who your host is or what they're responsible for, our guide to what website hosting is and who looks after what explains the parts. If someone else built the site, call them too. They may know which plugins and logins are involved.

3. Change every password and turn on multi-factor authentication

Assume every login connected to the site is known to the attacker. Google's recovery steps say to check the list of user accounts for any the hacker created, note them, delete them, then change the passwords for every account.

• Website admin: WordPress, Wix, Squarespace or whatever runs your site, including every staff login.
• Hosting control panel, FTP or SFTP and the database. These are the back doors people forget.
• Domain registrar: whoever controls the domain controls where it points. Our guide on buying and managing a .com.au domain covers where that account lives.
• Business email, Google Search Console, Google Business Profile and any payment or booking tools linked to the site.

Change them from a device you trust, use a different passphrase for each, and turn on multi-factor authentication (MFA) wherever it's offered. The ACSC calls MFA one of the most effective ways to stop someone getting into your accounts. Google also lists reused and guessable passwords as a common way sites are compromised.

If a former web designer or agency still holds the main logins and won't hand them over, this is the moment to sort it out. Our guide on what to do when a web designer won't give you access walks through getting control back.

4. Restore from a clean backup, or clean the site

There are two ways back: restore a backup taken before the hack, or clean the infected site file by file. Google's first check is simple: make sure the backup was created before your site was hacked. Restoring a backup made after the attacker got in just restores the attacker.

If you have a clean backup

• Restore it, then straight away install every available update for the platform, theme and plugins.
• Remove anything you don't use: old plugins, themes and test copies of the site. Delete their files, don't just switch them off.
• Find and fix how they got in. An outdated plugin and a stolen password are the usual suspects. If you skip this, the same hole gets used again.
• Re-add any genuine changes made since the backup, by hand.

If there's no clean backup

Cleaning means finding every changed file, injected script, spam page and hidden admin account. It needs technical skill, and missing one piece means the hack comes back. This is usually the point to bring in your host's security team or a developer. If the site is old, built on a platform nobody maintains, it can be quicker and safer to rebuild than to clean. Our list of signs your website needs a redesign can help you decide.

5. Remove Google's hacked site warning in Search Console

Google won't lift a warning on its own just because you fixed the site. You have to ask. Google's help for hacked sites lists four things to finish first: verify you own the site in Search Console, clean the site, fix the vulnerability, and bring the clean site back online.

• Open the Security issues report in Search Console and check every issue type listed.
• Select Request review and explain what you did for each issue, in plain words.
• Make sure the problem is truly fixed first. Google warns that asking too early only keeps the warning up longer.
• Check the clean pages can be crawled. Pages blocked by robots.txt or a noindex tag can't be checked.

Here's the kind of explanation Google asks for, adapted to your situation:

Content injection: we removed the spam pages and injected code,
restored the site from a backup taken before the hack, updated
the platform and all plugins, removed an unused plugin that was
out of date, deleted an unknown admin account and changed every
password with multi-factor authentication turned on.

How long it takes depends on the problem. Google says reviews for sites hacked with spam can take up to several weeks, malware reviews take a few days, and phishing reviews take about a day. Once Google finds the site clean, it says warnings in browsers and search results are removed within 72 hours. If traffic is still low after that, our guide to why your website isn't showing up on Google covers the next checks.

6. Check whether personal information was exposed, and report it

Many small business sites hold personal information: enquiry forms, bookings, customer accounts, newsletter lists. If an attacker could reach that data, you need to work out whether it was accessed, and whether you have to tell anyone.

The Notifiable Data Breaches scheme

The Notifiable Data Breaches (NDB) scheme applies to organisations and agencies covered by the Privacy Act 1988. Small businesses with an annual turnover of $3 million or less are generally not covered, but some are covered regardless of turnover. The OAIC lists exceptions including health service providers, businesses that trade in personal information, Commonwealth contractors and businesses that have opted in. Check the OAIC's small business page if you're unsure.

• What counts: an eligible data breach is unauthorised access to, or disclosure or loss of, personal information that is likely to result in serious harm to someone, where you haven't been able to prevent that harm with remedial action.
• How fast: if you suspect a breach, you must take all reasonable steps to assess it within 30 calendar days. The OAIC expects that to be a maximum, and much quicker where possible.
• Who to tell: if it is an eligible breach, you must notify the affected people and the OAIC as soon as practicable, including what they should do to protect themselves.

Even if your business isn't covered, telling customers whose details may have been taken is usually the right thing to do. IDCARE, a national identity and cyber support service, can help organisations and individuals respond when information is at risk.

Report it through ReportCyber

Report the hack through ReportCyber at cyber.gov.au. It's the Australian Cyber Security Centre's portal for reporting cybercrime and cyber security incidents, and reports go to police. If you need help on the spot, the Australian Cyber Security Hotline is open 24 hours a day, 7 days a week on 1300 CYBER1 (1300 292 371). If bank or card details were stolen, call your bank straight away.

7. How to stop your website being hacked again

Most small business hacks use the same few weaknesses: old software, extra plugins, weak or reused passwords and too many people with admin access. The ACSC's small business guide starts with three measures: turn on multi-factor authentication, update your software and back up your information. After that, it recommends small businesses work towards Maturity Level One of the Essential Eight.

• Keep everything updated: the platform, theme and every plugin. Google lists missed security updates and outdated plugins and themes as major ways sites get hacked.
• Fewer plugins: remove any plugin or theme you don't use or that's no longer maintained, and never install free copies of paid plugins from unofficial sites.
• Automatic backups, kept away from the website itself, and test that you can actually restore one.
• MFA on every login that touches the site, domain and email.
• Least privilege: give each person their own login with only the access they need. Google lists admin access for users who don't need it as a security hole.
• Someone responsible: updates only happen if a named person or provider does them every month.

That last point is where most small business sites fall over. Nobody is paid to watch the site, so updates wait until something breaks. Our guide to website maintenance costs in Australia explains what ongoing care involves and what it typically costs. At Lumeen, every site we build is hosted on a plan that includes SSL, DDoS protection, automatic backups and updates, so security isn't left to chance.

Key takeaways

1. (01)

   Confirm the hack with a site: search and Search Console's Security issues report, and log everything you do.

2. (02)

   Take the site offline with a maintenance page served from outside the hacked site, call your host, then change every password and turn on MFA.

3. (03)

   Restore a backup from before the hack or have the site cleaned, fix how they got in, then request a review in Search Console.

4. (04)

   Check whether personal information was exposed, meet any Notifiable Data Breaches duties, report through ReportCyber, and keep updates, backups and MFA running every month.

Frequently asked questions

More answers on price, hosting and timing in our FAQ.