If you have just found strange pages, redirects or a warning from Google on your site, you need to act in a set order. Knowing what to do if your website is hacked matters more than knowing why it happened. The first hour decides how much damage is done to your customers, your search ranking and your data. This guide walks through the steps we follow when a client site is compromised.
Confirm the breach before you act
Some signs are obvious, such as a homepage that shows someone else's content. Others are quieter: customers say they were sent to a strange website, your hosting provider flags unusual traffic, or your browser shows a security warning when people visit. Write down what you see, with screenshots and times, before you change anything. That record will help whoever fixes the site and any regulator or insurer you may need to speak to later.
Step 1: Put the site into maintenance mode
Take the site offline or show a simple holding page while you investigate. This stops visitors from being infected, stops the attacker from harvesting more data through your forms and checkout, and stops search engines from indexing spam pages. A short page that says you are doing maintenance is far better than a site that keeps leaking information.
Step 2: Lock down access
Most attacks come through stolen or weak logins, so this step is urgent:
- Change the passwords for your hosting account, domain registrar, email, content management system and database.
- Remove users you do not recognise, and give each remaining person only the access they need.
- Turn on two-factor authentication wherever it is offered.
- Revoke old API keys, plugin tokens and FTP accounts, then issue new ones.
- Check your email account for forwarding rules the attacker may have added. Many intruders keep control this way.
Change passwords from a clean device, not the one that may be infected.
Step 3: Find out what was changed and what was taken
Your developer or hosting provider should review three areas. First, the files: look for new or modified files, hidden scripts and injected code, especially in upload folders. Second, the database: look for new admin accounts, changed content and unfamiliar records. Third, the logs: server and access logs show when the intrusion started and which pages were used to enter.
Be honest about customer data. If your site stores names, phone numbers, addresses, order history or payment details, ask whether any of it could have been viewed or copied. This is the question that determines your legal duties.
What to do about customer data
If personal data may have been exposed, treat it as a serious incident. Nigeria's Data Protection Act 2023 requires certain personal data breaches to be reported to the Nigeria Data Protection Commission within a short deadline, which the Act sets at 72 hours from awareness. Speak to a lawyer or data protection adviser early so that you do not miss it.
Tell affected customers clearly and quickly. Say what happened, what information may be involved, what you have done, and what they should watch for, such as phishing emails that use their name. Avoid vague wording. Customers forgive an incident they hear about from you; they rarely forgive one they learn about from someone else.
Step 4: Restore from a clean backup
The fastest safe recovery is usually a restore from a backup taken before the infection. Check the backup date against your log findings, because a backup made after the attacker got in will contain the malicious code. If you do not have a recent clean copy, a developer may need to remove the injected code by hand, which takes longer and carries more risk.
After restoring, do not simply put the site back online. Update every plugin, theme, framework and library, and remove anything you no longer use. Outdated software is one of the most common ways in.
Step 5: Close the gap and harden the site
Once the site is clean, find out how the attacker got in and fix that specific weakness. Common causes include an outdated plugin, a weak admin password, an exposed test folder, a misconfigured server or a form that accepts code it should not. Then put lasting protections in place:
- Automatic backups stored away from the main server, with a tested restore process.
- Regular updates and a short monthly review of users and installed software.
- Web application firewall and malware scanning on the site.
- Valid SSL certificate and HTTPS enforced on every page.
- Monitoring that alerts you when files change or the site goes down.
If you do not have someone checking these things, consider ongoing support. Our website and app services include the maintenance and security work that prevents a repeat of this situation.
Tell search engines and your customers the site is safe
Once the site is clean, ask Google to review it through Search Console if you received a security warning. Check your pages, forms and redirects again a few days later. Post a short notice on your social channels or email list if customers were affected. Keep your message calm and factual.
Frequently asked questions
Should I pay a ransom if my website has been held hostage?
Do not pay before you have a clean copy of your data and a clear view of the attack. Payment does not guarantee the attacker will remove the infection or leave your data alone. Get professional help and legal advice first, then decide with full information.
Can I fix a hacked website myself?
You can take the site offline, change passwords and restore a backup yourself if you have one. Finding every injected file and closing the original entry point usually needs a developer. Trying to clean a site without that skill often leaves a backdoor behind.
How do I know if customer data was stolen?
Check server and access logs, database activity, and any unusual exports or downloads. You may not get a definite answer quickly. If you cannot rule out exposure, treat the incident as a possible personal data breach and get advice on your reporting duties.
Will my Google ranking recover after a hack?
Often it does, once the spam pages are removed, the security issue is fixed and Google has reviewed the site. Recovery can take weeks, depending on how much spam was indexed and how quickly you respond. Keeping clean backups and monitoring your site reduces the time lost.
If your website has been compromised, or you want to make sure it never is, we can help you contain the problem and put a plan in place. Start a project brief or contact the Icoweb team and we will reply with next steps.
