Help! My Website Was Hacked: Response Playbook for Small Business Owners
If you think someone hacked your website, don’t panic. You can get through this. This guide walks you through each step to stop the damage, fix your site, and protect it going forward.
Need immediate help? Contact RSS Digital Marketing Group for emergency incident response to get your site back online safely.
How Do I Know If I’ve Been Hacked?
Watch for these warning signs:
- Someone created new admin accounts you don’t recognize.
- Your site redirects visitors to strange pages.
- You see spam pages or posts you didn’t create.
- Your homepage looks different or has weird content.
- If you or anyone else can’t log in to your site.
- Google says your site has malware.
- Your site runs much slower than usual.
If you use Defender Pro (a security plugin), it might send you alerts. Check your email for warnings about suspicious activity. Don’t ignore these.
Step 1: Immediately Stop the Problem
First: Take Pictures First
Before you act, take screenshots to document what you see.
In Defender Pro, download recent Activity Records. Note dates, times, and unknown users. This info helps with insurance or legal needs.
Next: Put Your Site in Safe Mode
Enable maintenance mode to display a simple page to visitors. Most hosts offer this, or use a free WordPress plugin.
If hackers are using your site to send spam, temporarily block search engines. You don’t want Google to see the spam and punish your site.
Turn on Lockouts in Defender Pro and hide your login page to block hackers.
Not sure how to do this? Our team can handle the technical setup while you focus on your business. Schedule emergency support right away.
Then: Change All Passwords Right Now
Secure your website by resetting all user passwords. Use strong, new passwords (at least 12 characters, including numbers and symbols). Enable two-factor authentication (2FA), which requires both your password and a unique code sent to your phone at login.
Remove any unrecognized user accounts. When unsure, delete the account; you can create new ones as needed. Playing it safe is important during a hack.
Next: Call Your Hosting Company
Contact your hosting company right away and report the hack. They can check their server logs for any unusual activity. They may have already noticed attacks on your account. Ask about their backup plans, too. Some hosts automatically restore sites. This might erase proof of how the hack happened.
Finally: Scan for Bad Files
Run a full Defender Pro scan to find any files left by hackers. After scanning, don’t delete everything. First, separate the bad files from the good ones, and note their locations and the related plugins or themes. This process preserves evidence and prevents further damage.
Step 2: Find and Test a Clean Backup
First: Look at Your Backups
Check your backup history. Find your most recent clean site version. Use Defender’s activity records to see when the hack began. Restore a backup from before that date to ensure your site is safe.
Don’t have backups? This is a critical problem. Contact RSS Digital Marketing Group immediately. We may be able to recover your site and set up proper backup protection going forward.
Next: Test the Backup First
Always test backups on a test site before restoring to your live website. This avoids affecting your real site or visitors. Most hosts offer test sites; contact support if you need help setting one up.
Then: Check That the Test Site Is Clean
After restoring your backup to the test site, run a security scan. Use Defender’s virus scan and check main pages, especially contact forms and checkout areas.
Only move to the next step when you’re sure the test site is both clean and working right.
Step 3: Get Back Online Safely
First: Restore Your Live Site
Once your test site is clean, safely restore it to your live site. Keep maintenance mode on during final checks.
Next: Make Your Site Stronger
Set up 2FA for all users.
- Set strong password rules.
- Remove any old plugins (extra software features you installed) you no longer use.
- Update all software to the latest versions.
- Set up automatic updates with backup protection.
Defender Pro can recommend specific security settings for your site.
Feeling overwhelmed? Let our security experts handle the hardening process. We’ll make sure your site is properly protected before going live again.
Then: Tell Your Customers
If data was stolen or your site was down, update customers briefly. Say the issue is fixed and their info is now secure. Share new safety steps, but skip technical details.
Finally: Write Down What Happened
Write a simple report: timeline, how hackers got in, your fix, and new security steps.
Keep copies of Defender logs and backup records. Your insurance company might want to see this information.
Why Do Websites Get Hacked?
Hackers look for the easiest ways to get in. They target websites using simple passwords like “password123.” Old plugins create another way in because they don’t have security fixes. Many small businesses grant admin access to too many people, increasing the risk of stolen accounts. Old themes and plugins that don’t get security updates are easy targets, too.
Defender Pro can identify these weak spots on your website and generate reports detailing what needs to be fixed.
What NOT to Do
Don’t start deleting lots of files when you’re panicked. Without good backups, you might make things worse. Never restore a backup directly to your live website without testing it first on a test site. When changing passwords, create completely new ones. Don’t reuse parts of old passwords. Most importantly, a normal-looking website doesn’t mean it’s clean. Hackers often hide bad code in places you won’t see.
When to Get Professional Help
Call for help if:
- You accept credit card payments on your site.
- You store customer personal information.
- You can’t figure out how hackers got in.
- Your site keeps getting reinfected after you clean it.
- If any step in this guide feels too technical or confusing.
- You don’t have time to handle this yourself.
Professional security teams can identify problems faster and clean up your site more effectively.
RSS Digital Marketing Group specializes in WordPress security incidents. We’ve helped dozens of local businesses recover from hacks and prevent future attacks.
Our Recommended Tools
We use two main tools for our clients:
Defender Pro finds security problems, blocks attackers, and scans for malware. It also keeps detailed logs of who does what on your site.
Snapshot creates automatic backups stored safely off your server. It keeps 30 days of backup history, making it easy to restore clean versions.
Together, these tools help you spot problems early, stop attacks, and recover quickly if something goes wrong.
Want these tools installed and managed for you? Our website hosting packages include both Defender Pro and Snapshot, fully configured and monitored by our security experts.
Ready to Secure Your Website?
If you’re dealing with a hack right now, don’t wait. Get a free Security Assessment. We’ll look at your current situation and show you exactly what needs to be fixed.
Our Managed Incident Response service uses Defender Pro and Snapshot to stop attacks, clean up your site, and prevent future problems. We handle the technical work so you can focus on running your business.
Three ways we can help you today:
- Emergency Response: Contact us for immediate help with an active hack.
- Free Security Assessment: We’ll review your current setup and show you what’s at risk.
- Managed Security Service: Let us handle ongoing protection so this never happens again.
Contact us now to protect your business reputation and get back online safely.