Your Website Hacked? Don't Panic: 6 Critical Actions to Save Your Business

Serhii Shypylov

• 3 min read
Share
Your Website Hacked? Don't Panic: 6 Critical Actions to Save Your Business

Take a Second — Then Start Acting

You wake up, open your site — and there's casino ads, an email from your hosting about suspicious traffic, or a completely white screen. Sound familiar? Don't panic. Every minute of hesitation costs money.

First rule of a hacked site owner: don't treat symptoms until you've stopped the cause. Don't close the page — move to the plan.

Step 1: Immediately Disconnect the Site from the Outside World

This isn't panic — it's insurance. If an attacker is using your site to send spam or steal data, you become an accomplice.

  • 🔒 Block access to the site via .htaccess or the hosting control panel (set a 503 status).
  • 🛑 Disable FTP, SSH, and the database — don't let the hacker establish a foothold.
  • 📧 Notify your hosting provider — they often block IPs or provide a snapshot.
Don't fully shut down the server if you're unsure — better to temporarily restrict access but keep the logs.

Step 2: Make a Copy of Everything You Can

Before changing anything — preserve evidence. Without a copy, you'll lose the chance to understand how the breach occurred.

  • 📂 Download all files via FTP (even the infected ones).
  • 🗄️ Export the database to SQL.
  • 📋 Copy the server logs (access.log, error.log) — this is the crime scene.

Important: Do not delete anything. Even if you see obviously malicious code — leave it in the copy for analysis.

Step 3: Find the Hacker's Entry Point

You can't close a hole unless you know where it is. Common scenarios: outdated plugins, weak passwords, SQL injections.

  • 🔍 Check files for suspicious changes (compare against a backup).
  • 👀 Review logs: which IPs, which pages, what time — this will point to the attack method.
  • 🧪 Scan the site with online tools (e.g., Sucuri SiteCheck).
If you haven't found the hole in 30 minutes — it's not your fault, but a signal to call a professional.

Step 4: Assess the Scope — What Was Stolen or Compromised?

You need to know if customers were affected. If it's an e‑commerce store — check payments and personal data.

  • 💳 Check for fake orders or altered prices.
  • 📧 See if emails were sent from your domain.
  • 🔐 Change all passwords: admin, database, hosting, CMS.

If you discover a customer data breach — prepare a notification, but do not publish until consulting with a lawyer.

Step 5: Clean the Site and Close the Holes

Only after copying and analysis can you remove malicious code. The most reliable method is restoring from a clean backup.

  • 🔄 Upload the latest clean backup (files + database).
  • 🩹 If no backup exists — delete obviously infected files (e.g., .php files with base64 code).
  • 🛡️ Update everything: CMS, plugins, theme — hackers often exploit known vulnerabilities.
A clean backup is the only guaranteed solution. If you simply remove the virus, the hacker will leave a backdoor, and it will happen again.

Step 6: Restore Operations — But with Enhanced Security

Only reopen the site after verifying all vulnerabilities. Enlist a specialist for an audit if you're unsure.

  • 🔐 Enable two‑factor authentication for all admins.
  • 📊 Set up file monitoring (e.g., via a file integrity plugin).
  • 📅 Create backups regularly — daily for stores, weekly for blogs.

And most importantly — don't hesitate to call a professional. If you're not an IT specialist, cleaning it yourself may only worsen the situation. Better to pay once for an audit than to lose your reputation forever.

Summary: Your Security Is a Plan, Not Panic

A hack is not the end of your business — it's a serious lesson. Remember these 6 steps: disconnect, copy, find the hole, assess the damage, clean, strengthen defenses. Act systematically — and your site will be stronger than before.

90% of hacks happen due to human negligence: old passwords, forgotten plugins, lack of backups. Don't be part of that statistic.

📬 Get in touch

Want to implement this in your business? Contact us!

UA EN RU
Contact us
Telegram
WhatsApp
Email