1. Contain the damage
If the site is redirecting visitors, serving malware, sending spam or skimming payments, stop that first. Put the site into maintenance mode, restrict access by IP in your hosting panel, or temporarily disable the checkout. Protecting your visitors comes before keeping the site online.
2. Take a copy before you change anything
Download a full copy of the files and the database as they are now, and save the web server access logs (they are often rotated after a few days). Store the copy offline and label it clearly as infected. It is the evidence you will use to work out how the attacker got in and which files they touched.
3. Change every credential
Assume anything stored on the server or used to manage it is known to the attacker. From a clean device, change:
- Hosting control panel, SSH/SFTP and FTP passwords and keys.
- Database passwords (and update them in the site configuration).
- All CMS administrator passwords. Log out all sessions; in WordPress, changing the salts in
wp-config.phpdoes this. - API keys and tokens stored in configuration files: payment providers, email services, cloud storage.
- Registrar and DNS account passwords, and turn on two-factor authentication everywhere it is offered.
4. Work out the scope
Find what was changed: files modified around the time of the hack, unknown administrator accounts, new scheduled tasks, injected database content and changes to .htaccess or server configuration. On WordPress, compare core and plugin files with official checksums (wp core verify-checksums, wp plugin verify-checksums --all). Check whether other sites in the same hosting account are infected too: they often are.
5. Clean or restore
You have two options, and the first is usually faster and more reliable:
- Restore a clean backup from before the compromise, then update everything. The hard part is knowing the backup is clean: compare it with the infected copy and the date of the earliest malicious change.
- Clean in place: reinstall core, plugins and themes from official sources (not from the infected server), remove unknown files, review every remaining custom file and the database for injected code, and delete unknown users.
Either way, reinstalling from official sources is safer than editing infected files one by one: a single missed backdoor lets the attacker straight back in.
6. Close the way in
If you do not find and fix the entry point, reinfection is likely. The usual culprits are an outdated plugin or theme with a known vulnerability, a stolen or weak password, an exposed configuration or backup file, or another infected site in the same account. The access logs from step 2 often show the first suspicious requests.
7. Check the site again, from inside and outside
Rescan the server files, then check the site the way visitors and search engines see it, including from a phone via a Google result. A Webforta scan on your verified domain looks for injected scripts, hidden spam links, cloaked content shown only to Google and exposed files, and you can compare the result with the previous scan.
8. Request blocklist reviews
If Google flagged the site, fix every issue listed in Search Console's Security issues report, then use Request review. Do the same with any other blocklist that lists you. Requesting a review before the site is clean usually just extends the listing.
9. Tell the people who need to know
If personal data may have been accessed, you may have legal obligations. In the EU and UK, the GDPR generally requires notifying the supervisory authority within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to people. Card data incidents usually have to be reported to your payment provider. Take legal advice if you are unsure.
10. Harden and monitor
- Work through the WordPress security checklist or its equivalent for your platform.
- Set up file integrity alerts, uptime and content monitoring, so a reinfection is caught in hours rather than weeks.
- Put a firewall in front of the site and keep it in enforce mode once tuned.
- Make sure you have off-site, tested backups going forward.
When to hire a professional cleanup service
If you are not comfortable reading code and server logs, if the site handles payments or personal data, or if it has been reinfected after a cleanup, a professional malware removal service is worth the cost. Webforta does not offer malware removal. When choosing a provider, ask:
- Do they find and report the entry point, or only remove visible malware?
- Do they clean the database as well as files, and check other sites in the account?
- What happens if the site is reinfected within a given period?
- Do they provide a written report of what they found and changed?
- Will they help with blocklist review requests?
Your hosting company may also offer cleanup or be able to recommend someone, and the developer who built the site often knows it best.