Recover a hacked website or web app and lock it down

This guide is for small business owners, freelancers and developers whose website, online shop or web app has been defaced, is redirecting visitors, sending spam, showing a browser warning, or has leaked data. Panic leads to the two most expensive mistakes: wiping the server before you know how the attacker got in, and restoring a backup that still contains the hole. You will contain the damage, take back every account in the right order, find the entry point, choose between cleaning and rebuilding, and handle the legal and reputation side. At the end you will have a clean, hardened site, an incident log you can show insurers or the ICO, and a short list of controls that stop a repeat.

What is inside

• Full step-by-step method8 detailed steps with decision points
• Ready-to-use templatesIncident log · Email to your hosting provider or developer · Notice to affected customers
• Timed action plan7 stages from “Hour 0–1” to “Weeks 3–4”
• Costly mistakes to avoid4 traps and what to do instead
• Complete checklist12 items to tick off
• Insider tips and fixes4 tips and 4 common problems solved

Step by step

1. Confirm the compromise and start an incident log

   Write down the date and time you first noticed the problem and exactly what you saw: defaced pages, redirects only on mobile or from search results, unknown admin users, unexpected files, spam sent from your domain, a browser or Google Search Console security warning, or a customer reporting card fraud. Check from a separate device and network, because some injected redirects only trigger for first-time visitors or visitors arriving from Google. From this point, record every action you take with a timestamp in a single log; it will matter for your insurer, your bank or payment provider and the ICO. If you have cyber insurance, phone the insurer's incident line before you change anything, as many policies require early notice and provide a response team. If card details may have been taken, contact your payment provider the same day.