🌐 Website Hacked or Defaced — Recovery Guide

Step 1: Take the Site Offline (Immediately)

• Option A — Maintenance mode: Most CMS platforms have built-in maintenance mode. In WordPress: install a maintenance mode plugin or add a maintenance.php file. For Shopify: enable password protection.
• Option B — Hosting-level block: Use your hosting control panel to restrict access to your IP address only, showing a generic maintenance page to everyone else.
• Option C — Cloudflare: Create a "Always Online" or custom WAF rule that blocks all traffic except your IP.

Step 2: Change All Passwords — from a Clean Device

Change passwords for: hosting account, CMS admin, database, FTP/SFTP, and any email accounts associated with the site. Use a different, known-clean computer or phone for this. If you change passwords on the infected site's server, the attacker may capture them. Enable MFA on everything — starting with your hosting and domain registrar accounts.

Step 3: Find the Infection

• Check Google Search Console: Under Security & Manual Actions → Security Issues, Google will tell you exactly what type of malware or hacked content it detected and which URLs are affected.
• Scan with a malware scanner: Wordfence, Sucuri SiteCheck (free online scanner), or your host's built-in malware scanner. These tools identify known malware signatures, backdoors, and suspicious file modifications.
• Check recently modified files: Via FTP or your hosting file manager, sort files by modification date. Look for recently changed files that should not have been modified — especially in wp-content/uploads, wp-content/themes, and the root directory.
• Look for suspicious admin accounts: Check your CMS user list for any accounts you did not create — especially ones named "admin," "support," "test," or with generic names.

Step 4: Clean or Restore

If you have a clean backup (recommended): Wipe the server completely. Reinstall your CMS from scratch. Restore your database and uploads from your last known-clean backup. Do NOT simply restore over the infected files — many infections hide in files that appear legitimate.

If you do not have a backup (more work): Manually review every file. Remove all malware. Replace core CMS files from a fresh download. Reinstall all themes and plugins from official sources. Delete any files that should not be there. This is tedious but necessary — one missed backdoor and the attacker returns within hours.

Step 5: Harden Before Going Back Online

1. 1. Update everything: CMS core, themes, plugins, PHP version. The attacker likely exploited an outdated component — if you do not update it, they will be right back in.
2. 2. Remove unused plugins/themes: Every plugin is an attack surface. Delete any you are not actively using.
3. 3. Install a WAF: Cloudflare (free) + Wordfence (free for WordPress) blocks most attacks before they reach your site.
4. 4. Limit login attempts: Install a login limiter. Change the default admin URL (/wp-admin → /something-else).
5. 5. Set up file integrity monitoring: Plugins like Wordfence alert you immediately if any file changes unexpectedly.
6. 6. Set up automated daily backups: Off-site, automatic, tested. This is your safety net.

Step 6: Get Off Google's Blacklist

Once your site is clean, go to Google Search Console → Security Issues → Request Review. Google typically reviews within 24-72 hours. Be specific about what you found and how you fixed it. If your site was distributing malware, the review may take longer. While waiting, your site will show a warning in search results — this is normal and will clear once Google confirms the site is clean.