If your website has been hacked, the first move is to secure it without deleting anything. You save a copy of its current state, change all passwords and take the website offline until you understand how they got in. Then the malicious code is found and removed, the hole is closed and a review is requested from Google. With us the job is done with hour packages, 5 hours for €350, 10 hours for €600, 20 hours for €1,100. During business hours we start the analysis within the hour, and for emergencies we are reachable from 7 am to 11 pm, holidays included.
Below you'll find the signs of a hacked or breached website, the most common types of malware, the first-hour procedure, what not to do, the cleanup steps, the review request in Search Console and the cost. The procedures follow the official Google and WordPress documentation, linked at the end of the guide.
How to recognize it
How to tell your website has been breached
Google lists four signals, a direct warning saying the website has been hacked, a warning in the search results, spam content (words and links) that Google sees and you don't, and pages you didn't create that show up as indexed. On top of these come the signs we see most often on WordPress and WooCommerce websites.
- The website makes strange redirects to gambling, pharmacy or fake store pages, often only on mobile or only for visitors coming from Google.
- Titles in Japanese, Chinese or with nonsense text appear in the search results next to your domain.
- There are administrator users in the dashboard that you didn't create.
- You find PHP files in folders where there shouldn't be any, for example in wp-content/uploads, or recently modified files when nobody has touched the website.
- The hosting provider suspends the account, or your domain's email ends up in spam.
- The browser shows a dangerous site warning instead of your home page.
The check to do right away
Search Google for site:yourdomain.com and look through all the indexed pages. If you see some you never published, the problem is real. Then register the website in Search Console and open the Security issues report, where Google lists sample URLs in which it found compromised content. If you see nothing strange on the flagged URLs, it may be cloaking, meaning the website shows you a clean page and Google a page full of spam. In that case the URL Inspection tool shows you the page as the search engine sees it.
Types of attack
What malware you find on a hacked website
Whoever breaks into a website usually doesn't want to destroy it, they want to use it. That is why malware tries to stay hidden from the owner for as long as possible. Google has a guide for each of the most frequent cases, and they are the ones we find on WordPress websites too.
- Japanese keyword spam. Thousands of pages in Japanese, often fake stores, created under your domain and indexed by Google. The owner usually doesn't see them until they search site: followed by the domain.
- Gibberish pages. Pages full of words strung together at random, designed to rank for spam searches and send traffic elsewhere.
- Hidden words and links. Spam text and links inserted into the real pages, invisible to visitors but read by Google. This is the cloaking case described above.
- Malware aimed at visitors. Scripts that send visitors to scam websites or try to get them to download infected programs. This is the case that triggers the red warning in the browser.
- Backdoors. Files or lines of code that let the attacker get back in even after the cleanup. They are the reason a website cleaned in a hurry gets reinfected a few days later.
- Code in store checkouts. On an e-commerce site malware can read card details or change payment details. That is why on a store a WooCommerce expert also checks checkout and payments, not just the files.
- Spam sent from the server. The website is used to send emails, and your domain's real email ends up in spam or gets blocked.
Not every slow or odd website has been hacked. Sometimes the problem is bot traffic that doesn't get into the website but floods it with requests, as in the case of the botnet stopped on the AVSolutions store. Diagnosis comes before any cleanup.
First hour
Hacked website, what to do in the first hour
- Make a copy of the entire current state, files and database, even if infected. You need it to understand what happened and to recover the real content. Save it off the server.
- Put the website in maintenance mode. Google recommends taking it offline by returning a 503 status code from a point outside the infected folders, because a holding page served from the same compromised server offers no guarantees. Your hosting provider can help you set it up. The robots.txt file doesn't protect visitors, it only blocks search engines.
- Change all passwords for WordPress administrators, FTP or SFTP, database, hosting control panel and email. First check the list of users and delete the ones you don't recognize. Do it from a clean computer, because if the login was stolen from an infected PC, the new password would be stolen again.
- Notify your hosting provider. They can tell you whether the problem affects only your account or other websites on the same server too, and can give you the access logs.
- Note when it started. Date of the Google warning, modification date of the suspicious files, first anomalous logins in the logs. You'll need it to choose a clean backup.
- If it is an e-commerce site with customer data, assess the notification obligation right away. The GDPR (article 33) in many cases requires notifying the data protection authority (in Italy, the Garante) within 72 hours of becoming aware of the breach.
If you are not sure what you are doing, stop after step 1 and call us. A badly done cleanup costs more than one done right the first time.
Common mistakes
What not to do with a breached or infected website
- Don't delete everything and start over. You lose the evidence of how they got in, and often the real content too, such as orders, users and posts. And if the hole stays open, the website gets hacked again.
- Don't restore a backup without understanding. The backup may already contain the malware, and even if it is clean the vulnerability stays open. Google distinguishes three cases, a clean and recent backup, a clean but old backup, no backup. The procedure changes for each one.
- Don't trust a single scan. A security plugin finds the malware it knows. Hidden access points, called backdoors, often remain and let attackers back in after the cleanup.
- Don't update WordPress over the infected installation. An update doesn't delete the files the hacker added. Google recommends a clean installation and moving over only the verified content.
- Don't request a review from Google before you are done. A request sent too early is rejected and extends the period during which the website stays flagged.
- Don't keep the old passwords. Even a single stolen credential that hasn't been changed is enough to get back in.
Cleanup
How to clean up a hacked WordPress website
These are the steps we follow on a compromised WordPress website, in line with Google's guide to cleaning up hacked websites.
- Diagnosis. We look at server logs, file modification dates, users and anomalous activity to understand when and how they got in. There are often several independent access points, which is why we don't stop at the first malware we find.
- Choosing the route. With a clean and recent backup you restore and update everything. With a clean but old backup you compare it with the infected copy and recover only the good content. With no backup you work on a copy of the website and clean the files one by one.
- Clean reinstallation. WordPress core, plugins and themes are downloaded again from official sources. With WP-CLI you can check that core and plugin files match the originals (wp core verify-checksums and wp plugin verify-checksums --all). Plugins and themes no longer needed are deleted, pirated ones are not put back.
- Checking folders and database. PHP files inside uploads, strange files in mu-plugins, malicious rules in .htaccess, code added to wp-config.php, and in the database scripts or iframes slipped into posts and options.
- Closing the hole. The cause is identified, which can be an outdated plugin or theme, a weak password, an infected administrator computer or code that accepts input without validating it. If you don't close this point, the cleanup doesn't last.
- New credentials and keys. Passwords for every login and the security keys in wp-config.php, so stolen sessions stop working.
- Spam pages. The pages created by the hacker have to be deleted and must return a 404 error. Google provides the Removals tool in Search Console for removing URLs, to be used only for these pages and not for legitimate ones.
- Final check and monitoring. The home page and the flagged URLs are checked as Googlebot sees them, and in the following weeks we keep an eye out for modified files reappearing.
If the website is a store, we add a check of checkout and payments to these steps, because malware can steal card details or change payment details. For e-commerce problems you'll find the details on the WooCommerce support and e-commerce troubleshooting page.
Search Console
How to request a review from Google after the cleanup
If Google says the website is compromised, the warning doesn't go away on its own and a review has to be requested. You need to be a verified owner of the website in Search Console.
- Use Wget or cURL to check the home page and one of the URLs the hacker had modified, and make sure Googlebot can reach them, with no blocks in robots.txt and no noindex tags.
- Make sure the cleanup is really finished and the hole is closed.
- Open the Security issues report in Search Console and find the flagged issue.
- Choose Request Review and describe, in your own words and briefly, what you cleaned and what you fixed, for example “removed the spam files and updated the vulnerable plugin”.
The timelines given by Google are about a day for phishing, a few days for malware, up to several weeks for hacked spam, because a manual check may be needed. Once the review is approved, the warnings in browsers and in the search results are removed within 72 hours. If it is rejected, the report shows more sample URLs. It means something is left, and you go back to checking files and database.
Once the warning is gone, check in Search Console that the spam pages drop out of the index and that the searches that used to bring you visitors start doing so again. If traffic doesn't pick up after a few weeks, an SEO ranking check is worth doing, because the spam may have left traces in links and indexed pages too.
Prevention
How to stop your website from being hacked again
The official WordPress guide on hardening points out that breaches depend more often on the application, meaning outdated plugins and software and weak passwords, than on the infrastructure. These are the measures to apply.
- Keep WordPress, plugins and themes up to date, and delete the ones you don't use. Automatic core updates have been available since WordPress 3.7.
- Download WordPress, plugins and themes only from official sources.
- Use long, unique passwords for every login, turn on two-step authentication and don't keep the user called “admin”.
- Connect to the server over SFTP instead of FTP, so passwords don't travel in plain text.
- Set correct permissions, with folders at 755 and files at 644, and wp-config.php at 400 or 440.
- Add the line define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php, which removes the file editor from the dashboard. It doesn't stop malicious files from being uploaded, but it closes a shortcut.
- Use a firewall, at plugin, server or network level.
- Make regular backups of files and database, kept off the server and with several restore points over time, so you always have a version from before the attack.
- Keep access logs and monitor file changes, so you notice an attack in days and not in weeks.
Keeping all of this under control every month is repetitive work, which is why most websites don't do it. With website maintenance on a monthly plan we take care of it, with updates to WordPress, theme and plugins, backups and fixing anything that stops working. For a one-off problem there is WordPress support with hour packages.
Costs
How much it costs to clean up a hacked website
We don't give a fixed price, because two hacked websites can have very different damage. A redirect inserted into a file is one thing, a website with dozens of backdoors and a database full of spam is another. We work with hour packages, and after the first analysis we tell you which package you need.
5-hour package
€350
one-time
- Analysis, cleanup and securing of the website
10-hour package
€600
one-time
- Analysis, cleanup and securing of the website
20-hour package
€1,100
one-time
- Analysis, cleanup and securing of the website
Indicative prices, every website is different. During business hours we start the analysis within the hour. We handle emergencies from 7 am to 11 pm, holidays included.
After the cleanup we advise you not to stay unprotected. Monthly maintenance costs €190 per month for a WordPress website and €290 per month for a WooCommerce store, and includes plugin updates, backups, fixing anything that stops working and, for the store, checks on orders, payment gateways and products.
If you want to know right away which package your website needs, leave your number and we'll call you back, or write to us describing what you see. For a compromised WooCommerce store you'll find the emergency service on the WooCommerce and PrestaShop support page.
Sources
Where we checked the procedures
- Google, web.dev, Help, I think I've been hacked
- Google, web.dev, How do I know if my site was hacked?
- Google, web.dev, Quarantine your site
- Google, web.dev, Clean and maintain your site
- Google, web.dev, Identify the vulnerability
- Google, web.dev, Request a review
- WordPress.org, Hardening WordPress
- Polizia Postale (Italian police unit for cybercrime), Commissariato di P.S. online
Procedures checked on the official pages on October 13, 2026.
Frequently asked questions
Frequently asked questions about hacked websites
How can I tell if my website has been hacked?
The clearest signs are a Google warning in the search results or in Search Console, pages you didn't create among the indexed ones, redirects to websites you don't know, unknown administrator users and recently modified files. On Google type site: followed by your domain and see whether strange pages appear. Then open the Security issues report in Search Console.
What should I do right away if my website is hacked?
Make a copy of files and database as they are, put the website in maintenance mode, change all passwords from a clean computer and notify your hosting provider. Don't delete files and don't restore backups blindly, because you would lose the traces of how they got in. The full first-hour procedure is in the guide above.
Who should I contact if my website has been hacked?
First of all your hosting provider, who can tell you whether the attack also affects other websites on the same server and give you the access logs, and whoever looks after the website for the cleanup. If customers' personal data has been exposed, the GDPR (article 33) in many cases requires notifying the data protection authority within 72 hours. In Italy, to file a complaint you contact the Polizia Postale, the Italian police unit for cybercrime, which on the commissariatodips.it website lists the information to provide for unauthorized access to a computer system.
How much does it cost to clean up a hacked website?
There is no fixed price, because it depends on how extensive the damage is. We work with hour packages, 5 hours for €350, 10 hours for €600, 20 hours for €1,100, and for emergencies we are reachable from 7 am to 11 pm, holidays included. After the cleanup you can start monthly maintenance, €190 per month for WordPress and €290 per month for WooCommerce.
Do you lose your Google rankings?
It is the attack that costs you rankings, not the cleanup. What hurts rankings is the Google warning and the spam pages created under your domain, which is why both have to be removed and a review requested in Search Console. A well-done cleanup recovers the real content, such as pages, posts, orders and users.
How do I stop it from happening again?
Keep WordPress, plugins and themes up to date and delete the ones you don't use, use long, unique passwords with two-step authentication, connect to the server over SFTP and make regular backups kept off the server. These are the measures in the official WordPress security guide. With a maintenance plan someone takes care of it every month.
How long does Google take to remove the warning?
According to Google it depends on the type of problem, about a day for phishing, a few days for malware, up to several weeks for hacked spam, because a manual check may be needed. If the review is approved, the warnings in browsers and in the results disappear within 72 hours.
Can I restore a backup to fix it?
Only if you know that backup predates the attack. If the malware was already there, you restore it along with everything else. And even with a clean backup the hole stays open, so the website gets hacked again. First you need to work out when the infection started and how they got in.