Website Hacked? Stop the Harm, Then Choose the Repair

Start with the host and your accounts

A new design can wait. The first job is to stop visitors being harmed without wiping out the clues.

1. Ask the host to save the files, database and logs before cleanup. Don't start deleting things or restoring backups yourself.
2. Record the affected address, the warning and the time you first saw it. Include when the site last looked right.
3. Use a trusted computer to change hosting, domain and password-reset email passwords. Coordinate the remaining account changes with the cleanup person.
4. Check your own computer for malware. The WordPress recovery guide includes a full local scan, not just a website scan.

Choose one person to coordinate the work. An unsolicited email offering cleanup is no reason to hand over administrator access.

Keep evidence and check for customer exposure

Keep the host's notice and any screenshot you can capture safely. Don't open a dangerous page just to photograph it.

Ask which accounts were affected, what the host detected and what backups or logs remain. Keep a record of each change.

A copy made after the hack may contain the hack. Label it as evidence rather than treating it as a clean backup.

Does the site collect personal details, accept payments or provide customer accounts? Tell the people responsible for those systems now.

The FTC's breach response guide explains notification duties and recommends legal counsel. The requirements depend on the information and laws involved.

Get qualified advice before deleting evidence or deciding nobody needs notice. A normal-looking home page doesn't prove customer information stayed private.

Agree on the scope before approving work

Give the cleanup person a list of the site's outside services, including payment or booking systems. Agree on a secure way to share access.

Ask how the attacker got in, what closes that opening and what remains unknown. A clean scan alone won't answer everything.

Have them check website users and hosting access. Google's Search Console instructions also cover checking authorized users and owners.

Read the Security Issues and Manual Actions reports with them. Keep the warning notices until the work has been checked.

Choose the least costly repair that holds up

Cleanup makes sense when the affected content can be identified and its removal checked. The quote should cover more than one visible spam page.

A restore needs a checked backup from before the compromise. You'll also need a plan for legitimate changes made since.

A rebuild may be worthwhile when the repair scope and cost justify it. List the pages, forms and booking links that must return.

Replacing the website won't repair stolen hosting or email access. Those accounts still need attention, whichever route you choose.

Google's cleanup guidance covers checking old backups, fixing the entry point, updating software and changing passwords.

Check the assumptions in a cost comparison

Suppose cleanup is $300 and rebuilding is $1,200. These are example amounts, not your quote. My published new-site starting price was $1,200 in September 2026.

One cleanup plus three more at $300 totals $1,200. That doesn't establish that four cleanups will happen.

A claimed 20% chance of one more $300 cleanup adds $60 in expected cost, making $360. The arithmetic works; the assumed risk still needs evidence.

That comparison leaves out your time, lost enquiries, investigation and the rebuild's risks. Don't let an invented percentage decide the job.

What about Google while the site is offline?

Google's quarantine guide recommends taking a compromised site offline during recovery. It says temporary interruptions are unlikely to affect future rankings.

That supports stopping the harm. It doesn't guarantee where the repaired site will rank.

Ask the host to provide the temporary unavailable response outside the compromised site. Blocking crawlers with robots.txt still leaves visitors exposed.

A noindex instruction isn't visitor protection either. Record temporary restrictions so they're reconsidered before the repaired pages reopen.

Don't leave the problem unattended. Google's HTTP guidance says persistent server errors can reduce crawling and eventually remove pages from its index.

Account for the useful page addresses

Record each old address, its purpose, the recovery decision and its final destination. Keep attacker-created addresses in a separate list.

Google's URL-move guidance calls for corresponding destinations, rather than sending unrelated pages to the home page.

Removed content that isn't moving should return 404 or 410. Have the person doing the work check menus and important customer links.

Request the right review after the repair

The Security Issues report shows examples, which may not include every affected address. Fix and check all reported issues before requesting review.

Explain the problem, the repair and the checks performed. Google says the review can take a few days to several weeks.

Wait for the decision before submitting another request. Record when the repair finished, when review was requested and when Google answered.

A manual action has its own report and reconsideration process. A warning and a ranking drop don't establish the same problem.

What I've learned from cleanup work

I've cleaned up hacked WordPress sites for years, including injected spam, outdated plugins and forms abused to send mail.

Fixing what looks wrong is only part of it. You'll want to know how the attacker got access.

WordPress 5.5 added optional plugin and theme auto-updates in August 2020. Ask whether they're enabled and who checks failures.

I expect that handover to matter more as maintenance becomes automated. Somebody still needs to notice a failed update or unusable backup.

Get a handover you can use

Before reopening, check the actual pages, forms and telephone links. Agree on who handles account access, updates and future warnings.

Keep the page list, changes, unresolved questions and next contact somewhere accessible when the website is down.

Find out which backup is for recovery and when somebody last tested a restore. Set an end date for temporary cleanup access.

Getting the damage assessed

I repair hacked and broken existing WordPress sites. Cleanup is quoted after assessment; ongoing WordPress care starts at $75 per month.

If replacement makes sense, a typical semi-static site with five to seven pages starts at $1,200. I'll quote the agreed scope before starting the work.

The pricing page explains the conditions. Emergency Web Help covers the service itself.