Website Hacked? Do These 5 Things in the First Hour

In short: when your website is hacked, the first hour is about order of operations: (1) take a forensic backup of the infected state, (2) contain - maintenance mode and credential rotation, (3) identify how they got in, (4) clean from a known-good base rather than whack-a-mole, and (5) start the blacklist-removal clock. Doing these in the wrong order - deleting everything first, or cleaning before finding the entry point - is how sites get re-hacked within a week.

Panic deletes evidence. The instinct when you see a defaced homepage or a malware warning is to tear everything down and restore an old backup immediately. Resist it. If you restore before closing the hole, you hand the attacker a freshly patched-looking site with the same open door. This checklist is the sequence we use and recommend - it works whether you run WordPress, a custom app, or a Laravel storefront.

Step 1 (Minutes 0-10): Take a Forensic Backup of the Infected Site

Before changing anything, capture the current state: all files and the database.

Why keep the infection? Because it is evidence. The modified-file timestamps tell you when the attack happened; the webshell code tells you what the attacker could do; the logs tell you how they arrived. Without this snapshot you are guessing, and guessing is how reinfection happens.

Practically: zip the entire webroot and dump the database from your hosting panel (cPanel has both under Backup). Store it outside the server. This backup is for forensics only - never restore from it.

Step 2 (Minutes 10-25): Contain the Damage

Containment is about stopping active harm and locking out the attacker without destroying evidence.

Enable maintenance mode or a static holding page. Most frameworks have this built in (Laravel: php artisan down; WordPress: plugins or hosting-level password protection). This stops customers from being served attacker content while you work.

Rotate every privileged credential, in this order:

1. Hosting control panel (cPanel/Plesk) password
2. CMS admin passwords, and delete any admin accounts you do not recognize
3. Database passwords (then update the config file)
4. FTP/SFTP and SSH keys
5. API keys and SMTP credentials stored in the site - attackers exfiltrate these for later abuse

Check for persistence. Attackers leave backdoors: new admin users, cron jobs running mystery scripts, modified .htaccess rules, additional SFTP accounts. Removing the visible malware without removing the backdoor is the number one cause of "we cleaned it and they came back."

Step 3 (Minutes 25-40): Find How They Got In

You cannot clean properly until you know the entry point. In rough order of likelihood for typical sites:

Outdated CMS, plugins, and themes. The single most common cause. Check every component's version against its changelog - especially anything not updated in months.

Weak or reused admin passwords. Credential stuffing against /wp-login.php or your admin route is constant background noise on the internet. Check access logs for repeated POST failures followed by a success.

Exposed sensitive paths. An exposed .git directory hands over your source code; a readable backup file or .env dumps your database credentials. These are cheap to check: a free security scan lists them in minutes.

Nulled themes and plugins. Pirated premium WordPress components are a documented malware distribution channel. If a premium plugin was downloaded from anywhere other than its official source, treat it as the prime suspect.

Vulnerable, forgotten subdomains. The main site is patched; the staging site from 2023 is not. Attackers love these. Our attack surface scan exists partly for this reason - it enumerates what you have forgotten you own.

Step 4 (Minutes 40-60): Clean From a Known-Good Base

The reliable cleanup method is rebuild-and-diff, not delete-the-obvious:

1. Export your content (posts, pages, products, users) - not the code - from the infected database.
2. Deploy a fresh install of the CMS/framework from official sources, plus plugins downloaded fresh (not copied from the infected copy).
3. Import the content back, then audit the imported data - attackers sometimes inject malicious admin users or scheduled posts into the database itself.
4. Diff old against new on custom code: diff -r clean/ infected/ shows every modified file. Anything you did not change is a change they made.

For a small site this takes an hour. For a larger one, it takes the rest of the day - but it is the only approach where you can honestly say the backdoors are gone.

Step 5 (Hour One, in Parallel): Start the Blacklist and Trust Recovery Clock

If Google or your browser flagged the site, the clock matters. Google Search Console's review queue takes days after you request a review - so clean first, then request immediately. Doing it the other way around (requesting review before the fix) wastes a cycle and lengthens the warning period.

While you are in Search Console, check the Security Issues report: it often tells you exactly what Google detected (malware injection, defacement, phishing page) - free forensic hints.

After the First Hour

The emergency is handled; now make reinfection hard:

• Update everything and turn on automatic updates for minor versions
• Add hardened security headers and verify your TLS setup with the SSL check
• Enforce 2FA on the CMS admin and hosting panel
• Set up recurring scanning - monthly at minimum - so the next outdated plugin is caught before attackers find it
• If customer data was touched, document what happened; in many jurisdictions, including under Bangladesh's cyber security expectations for financial services, timely disclosure to affected parties is expected

When to Call for Help

If the site handles payments, stores customer identity data, or the attacker persisted through your first cleanup - bring in professional malware removal. The cost of a proper incident response is consistently lower than the cost of a second incident a week after the first.

The first hour sets the trajectory. Backup, contain, locate, rebuild, delist - in that order - and you convert a crisis into a manageable project.