Most website owners find out about a hack from someone else. A customer messages to say the site opened a betting page. Google Search shows Japanese product listings under your company name. Your hosting company suspends the account for sending spam. By the time you hear about it, the attacker has often been inside for weeks.
The good news: almost every hacked site can be cleaned and secured. The bad news: panicking, deleting files randomly or restoring a backup without fixing the cause usually makes things worse. This guide covers the warning signs to watch for and a calm, step-by-step plan to recover.
Why small business websites get hacked
Attackers rarely target a business personally. Most attacks are automated - bots scan thousands of websites looking for known weaknesses. Common entry points include:
- Outdated plugins, themes or CMS core with publicly known vulnerabilities
- Weak or reused passwords on admin, hosting, FTP or database accounts
- Nulled (pirated) themes and plugins that come with hidden backdoors
- Abandoned plugins that no longer receive security fixes
- Old developer or staff accounts that were never removed
- Insecure file permissions or exposed configuration files
The goal is usually to use your site's reputation: to host spam pages, redirect visitors, send phishing emails or steal data.
Warning signs your website is hacked
Search and Google signals
- Google shows "This site may be hacked" under your listing.
- Browsers show a red "Deceptive site ahead" or similar warning.
- Google Search Console's Security Issues report lists problems.
- A "site:yourdomain.com" search reveals pages in foreign languages, pharmacy or gambling keywords - a sign of a spam injection attack.
- Organic traffic drops sharply or shifts to strange keywords.
What visitors see
- Redirects to other sites, sometimes only on mobile or only when coming from Google - so the owner, visiting directly on a desktop, sees nothing wrong.
- Pop-ups or ads you did not add.
- The site loads slowly or shows errors it did not show before.
Behind the scenes
- Unknown admin users in the CMS.
- Recently modified core files, or unfamiliar PHP files in the uploads directory.
- Your server suddenly using much more CPU or bandwidth.
- Hosting provider warnings or account suspension.
- Your domain's email landing in spam, or bounce messages for emails you never sent.
- Online store payments or order details behaving unexpectedly.
What to do if your website is hacked: step by step
Step 1: Stay calm and do not delete things randomly
Deleting files without understanding them can break the site and destroy evidence of how the attacker got in.
Step 2: Take a snapshot of the current state
Back up the infected site - files, database and logs - and store it separately. You will need it to investigate, and it protects you if a cleaning step goes wrong. Label it clearly so nobody restores it by mistake.
Step 3: Limit the damage
- Put the site into maintenance mode if it is redirecting visitors or serving malware.
- For online stores, consider pausing checkout until you know whether payment or customer data is affected.
- Inform your hosting provider; they may help with logs or isolation.
Step 4: Change every password
Change passwords for CMS admins, hosting panel, FTP or SFTP, database, email accounts and your domain registrar. Enable two-factor authentication everywhere it is available. Remove admin accounts you do not recognise.
Step 5: Find and remove the infection
- Compare core files with fresh official copies.
- Reinstall plugins and themes from official sources rather than trusting existing files.
- Scan uploads and other writable folders for scripts that should not be there.
- Check the database for injected scripts, spam posts and rogue admin accounts.
- Look for scheduled tasks (cron jobs) the attacker may have added to reinfect the site.
Step 6: Or restore a clean backup - carefully
If you have a backup from before the infection, restoring it can be faster. But you must still update everything, change passwords and close the weakness, otherwise the same bot will return.
Step 7: Close the door
- Update the CMS, plugins and themes to their latest versions.
- Remove nulled, abandoned or unused plugins and themes.
- Add a web application firewall (WAF) and login protection.
- Set correct file permissions and disable file editing from the admin panel.
- Upgrade to a supported PHP or framework version.
Step 8: Tell Google the site is clean
In Google Search Console, review the Security Issues report and request a review once everything is fixed. Remove spam URLs with proper 404 or 410 responses and submit an updated sitemap.
Step 9: Consider your legal obligations
If personal data of customers may have been exposed, take advice quickly. India's Digital Personal Data Protection Act, 2023 includes obligations around personal data breaches, and CERT-In's 2022 directions require certain organisations to report specified cyber incidents within six hours of noticing them. Your legal or compliance advisor can tell you what applies to you.
Step 10: Monitor closely for the next few weeks
Reinfection is common when a backdoor was missed. Watch file changes, admin logins, Search Console and uptime daily for a while.
Quick reference: symptom, likely cause, first action
| Symptom | Likely cause | First action |
| --- | --- | --- |
| Spam pages in Google results | SEO spam injection | Check Search Console, scan files and database |
| Mobile-only redirects | Malicious script or .htaccess rule | Inspect theme files, .htaccess and plugins |
| Unknown admin user | Compromised login or vulnerable plugin | Remove user, change all passwords, enable 2FA |
| Host suspended account | Malware or spam sending | Contact host, get logs, clean before restoring |
| Browser red warning | Phishing or malware detected by Safe Browsing | Clean thoroughly, then request a review |
| Email in spam or bounces | Mail script abuse | Find and remove mail scripts, check SPF, DKIM and DMARC |
Who should handle the clean-up?
A simple spam injection on a small site can sometimes be handled by a confident in-house developer following the steps above. Bring in an experienced team when:
- The site is an online store or handles customer data of any kind
- The infection keeps coming back after cleaning
- Your hosting provider has suspended the account
- Google or browsers are showing warnings to visitors
- Nobody on your side knows how the site was built or where backups are kept
A professional clean-up should end with a written note explaining what was found, how the attacker most likely got in, what was changed and what to do next. That note is valuable when you take legal advice, speak to your hosting provider or brief a future developer.
Prevention is far easier than recovery
Most hacks we see could have been avoided with a few routines:
- Regular updates with a backup before each update
- Off-site backups and periodic restore tests
- Two-factor authentication on every admin and hosting account
- Only licensed, well-maintained plugins - never nulled software
- Uptime and file-change monitoring so problems are caught early
- A short user list with no shared logins
These are exactly the tasks covered by a proper website maintenance plan. For sites handling payments or sensitive data, a deeper audit by our cyber security team adds another layer of protection.
Key takeaways
- Most website hacks are automated attacks on outdated software and weak passwords.
- Watch for Google warnings, spam pages, mobile-only redirects and unknown admins.
- Snapshot the infected site, change every password, clean or restore, then close the weakness.
- Request a Google review only when everything is clean.
- Check whether reporting obligations apply, and monitor closely afterwards.
If you suspect your site has been hacked, or want to make sure it never happens, book a free consultation. Our team in Jaipur will assess the site, explain what we find in plain language and send a written plan for cleaning and ongoing protection.
