My website has been hacked. What do I do first?

The first hour, in order

The order matters more than the speed. Almost every expensive hacked-site job I see got expensive because somebody started fixing before anybody had looked.

1. Take a full backup of the mess. Files and database, downloaded off the server rather than left on it. This is your evidence and your way back. Every hour that passes without one is an hour where a well-meant repair can make the site unrecoverable.
2. Change the passwords that matter. Hosting control panel, every website administrator account, the database, and the email account the website sends from. Use a different password for each and do not reuse anything from before.
3. Decide whether to stay up. If visitors are being served malware or redirected to another site, put up a holding page. If the site is defaced but not dangerous, it can usually stay while it is cleaned.
4. Look before you clean. When was each file last modified? Which administrator accounts exist, and when were they created? An account created at three in the morning six weeks ago tells you the date of the breach, which tells you which backup is safe to restore. Delete it first and you have lost that.

What not to do

• Do not restore an old backup and call it finished. If the way in is still open, an out-of-date plugin, a reused password, you have restored the site to the exact state that was successfully attacked. It comes back, usually within days.
• Do not repair infected files by hand unless you enjoy wondering. Replacing the platform, the themes and every plugin from a clean source removes what you found and what you missed, and it is quicker.
• Do not pay anyone who quotes a fixed price for the clean-up before looking. Nobody can price what they have not seen. A small fee to look, followed by a fixed quote, is the honest shape of this work. Anything else is a guess you are paying for.

How they got in, in order of likelihood

Not by guessing a clever password. Almost always one of these four:

1. An out-of-date plugin, theme or platform with a weakness that is published and searchable.
2. A premium plugin downloaded free from a site offering it free, with something extra bundled in.
3. A password reused from another service that was itself breached.
4. A forgotten development or staging site on a subdomain that nobody has updated in three years but which sits on the same hosting.

That last one catches people out badly, because they are certain they only have one website. Every certificate ever issued for a domain is on public record, which is how a forgotten old.yourbusiness.co.za gets found, by them, and by anyone checking.

Getting the Google warning removed

The warning is not the infection, it is Google’s response to it, and it does not lift on its own. Clean the site properly, then open Search Console, go to Security Issues and request a review. Google recrawls and normally clears it within a day or two. Asking for a review before the site is genuinely clean fails and puts you back at the start of the queue, which is why the tidying comes first.

What it should cost

In South Africa, expect somewhere between R1,000 and R2,000 for the triage, the part where somebody establishes what happened and quotes the rest, and R4,000 to R8,000 for a standard clean-up and hardening on a small business site. More if there are no usable backups, if there is a shop database involved, or if the site has to be rebuilt.

What you should expect for that money, and it is reasonable to ask for it in writing:

• A restore point taken before anything is touched.
• The platform and plugins replaced from clean sources rather than patched.
• Every account and password audited, and the way in closed.
• The Google warning lifted, not just the infection removed.
• A written summary of what was found.
• A re-clean guarantee: if the same infection returns within thirty days, it gets cleaned again at no charge.

What you should not expect, from anyone: a promise that the site is permanently clean. A backdoor is designed not to be found, and nobody can prove the absence of one. Treat that promise as a warning about the person making it.

Afterwards

A cleaned site drifts back. Plugins go out of date, somebody adds a new one, the administrator account you removed gets recreated for a contractor and left there. The honest fix is not vigilance, it is a monthly re-check that does not depend on anyone remembering.