Website Hacked? A Step-by-Step Recovery Guide (2026)

Complete guide to recovering a hacked website — identifying signs, isolating the site, removing malware, restoring from backup and preventing reinfection

Signs your website has been hacked

Many site owners do not realise they have been hacked until someone reports it or Google flags the site. Spotting the signs early greatly reduces the damage, because malware left in place spreads to other files and hurts your SEO.

• Your browser or Google warns "this site may be harmful"
• Strange pages or spam links (pharma/gambling ads) you never created
• Your homepage is defaced or redirects to another site
• Unusually slow loading or odd .php files inside public_html

5 things to do the moment you find out

Based on real-world use, do not panic-delete everything — you may destroy evidence and a clean backup you have not separated yet. Work calmly in order: stop the damage first, then recover.

1. Stay calm and record the time and symptoms as evidence
2. Change key passwords now: hosting panel, FTP, database and email
3. Contact your host's support — many can scan and help recover
4. Snapshot the current state (files + database) for later forensics
5. Do not pay any ransom, and do not delete server logs

Take the site offline temporarily

Putting the site into maintenance mode stops the malware from reaching visitors and prevents attackers from using your site to send more spam. You can still access the backend to clean up.

• Enable a maintenance page or restrict access with a password (.htpasswd)
• Temporarily disable unneeded plugins/themes to close attack vectors
• Block suspicious IPs via your panel or firewall
• Invalidate all active logged-in sessions
• Check cron jobs for malicious tasks the attacker may have planted

Scan for malware and injected files

The heart of recovery is finding which files were changed and what was injected. Malware often hides in files that look legitimate or uses obfuscated base64 code that is hard to read.

• Use your host's malware scanner such as cpGuard / ImunifyAV
• Compare files against the original CMS version or a clean backup
• Look for suspicious eval(), base64_decode(), gzinflate() code

Clean up and restore from backup

This is important — the safest and fastest route is to restore a clean backup from before the hack, then update everything to the latest version. Without a backup you must remove infected files one by one — slow and easy to miss something.

1. Restore a clean backup from before the hack (where auto-backups save you)
2. Update the CMS, all plugins and themes to the latest versions
3. Remove every unknown plugin, theme and user account
4. Regenerate system keys and salts (e.g. wp-config) to kill old sessions
5. Re-scan to confirm the site is truly clean before going live

Rotate all passwords and access keys

Even after cleaning the files, if attackers still have your old passwords they can return. Change everything related and enable two-factor authentication.

1. Change hosting panel, CMS admin and database passwords
2. Change FTP/SFTP passwords and delete unused FTP accounts
3. Regenerate all API keys and tokens you previously used

Request review to clear Google warnings

If Google has flagged or delisted your site, after cleaning you must request a review through Search Console — otherwise users keep seeing the red warning and your traffic stays gone.

• Verify ownership in Google Search Console
• Open Security Issues to see exactly what Google detected
• Fix every reported item, then click Request Review

Prevent re-infection and choose secure hosting

Recovery ends with long-term prevention. A site on hosting with automatic malware scanning and regular backups bounces back from incidents far faster. From our testing, our recommended provider asiagb.com runs cpGuard to continuously scan for malware and web shells, offers SSD storage managed through DirectAdmin, and has 24-hour Thai support that genuinely helps during an incident.

• Choose hosting with automatic malware scanning (e.g. cpGuard) and a firewall
• Enable automatic backups and test restores periodically
• Keep CMS, plugins and themes updated — never let them lag