Finding out your website has been hacked is stressful, but it can almost always be fixed. Here’s how to spot it, what to do straight away, and how we can help.
Signs your website may have been hacked
- Visitors are sent to other websites, such as spam or scam pages
- Google, or your browser, shows a warning such as “This site may be hacked”
- Pages, links or adverts appear that you didn’t add, sometimes in another language
- There are admin users in WordPress you don’t recognise
- You can’t log in, even with the right password
- Your website suddenly becomes very slow, or shows errors
What to do straight away
- Tell us. Please open a support ticket as soon as you can, and tell us what you’ve noticed. The sooner we know, the more options there are, including restoring from a backup taken before the problem started.
- Change your passwords – your WordPress admin, your Enhance panel, your client area, and any FTP accounts. Use strong, new passwords you haven’t used anywhere else.
- Check your WordPress users. Remove any admin users you don’t recognise. If you can’t log in, see how to reset a WordPress admin password with WP-CLI, or log in from your Enhance panel – see how to log in to WordPress from your Enhance panel.
- Remove FTP accounts you don’t need – see how to create an FTP account.
Don’t delay. Backups are kept for 30 days. The longer a hack goes unnoticed, the harder it is to find a clean backup from before it started.
How we can help
- Minor clean-ups – if the problem is small, we’ll help clean it up.
- Restoring from a backup – we can restore your website from your latest clean backup. See how to restore a backup of your website or email.
- Advice – we’ll tell you what to do to stop it happening again, such as updating your website and adding extra protection.
- In-depth help – if your website needs a more thorough clean and securing, and you’d rather not restore from a backup or do it yourself, we can do this for you as a chargeable task. We’ll always agree it with you first.
Stopping it happening again
Most hacked websites are broken into through out-of-date plugins, themes or WordPress itself, or through weak or reused passwords. Once your website is clean:
- Update everything – WordPress, plugins and themes. See how to manage WordPress updates and plugins in Enhance.
- Remove plugins and themes you don’t use.
- Add Patchstack, which protects WordPress against known vulnerabilities – see how Patchstack protects your WordPress website.
- Turn on two-factor authentication – see how to secure your PAC accounts in 5 minutes.
For a full checklist, see how to keep your WordPress website secure.
Worried about your website’s security? Please open a support ticket and we’ll take a look.
