Security
My website has been hacked — here is what you must do NOW (step-by-step plan)
10 June 2026 · 8 min read
A hacked website is every entrepreneur's nightmare. Your website is suddenly offline, showing strange content, or redirecting visitors to malicious sites. But panicking does not help. With this step-by-step plan from our experienced specialists — with more than 20 years of experience in web development and security — you can act quickly and decisively.
Step 1: Stay calm and take your website offline
The first thing you must do: temporarily put your website in maintenance mode. This prevents visitors from seeing malware, phishing content or spam. Do you still have access to your hosting panel? Then put up a maintenance page. No access anymore? Contact your hosting provider immediately.
An offline website is annoying, but a website spreading malware is catastrophic for your reputation AND your Google ranking. Google can blacklist your site, causing you to lose search traffic for months.
Step 2: Assess the damage
Before you restore anything, you need to know exactly what happened. Check the following: - Which files have been modified or added? - Have unknown user accounts been created? - Have suspicious plugins or themes been installed? - Are visitors being redirected to other websites? - Is your site spreading spam or malware? - Has sensitive data been stolen (customer data, passwords)?
At WP Maintainer we use specialised tools to map this completely. With our 20+ years of experience we quickly recognise what type of hack it is and what damage has been done.
Step 3: Change ALL passwords immediately
This is often forgotten, but is crucial. Change passwords for: - WordPress admin accounts - Database user - FTP/SFTP access - Hosting panel - Email accounts linked to the website
Use strong, unique passwords of at least 16 characters. A password manager such as 1Password or Bitwarden makes this easy.
Step 4: Restore from a clean backup
Do you have a recent, clean backup? Restore from it. Note: the backup must date from before the hack. After restoring, test whether the hack was not already present in the backup.
No backup? That is unfortunately often the case with cheaper hosting packages. Then contact WP Maintainer immediately. In most cases we can clean a hacked website without complete data loss. With our specialised tools and experience we have already successfully cleaned hundreds of websites.
Step 5: Clean up and strengthen
After restoring, it is time to thoroughly clean and strengthen your website: - Remove all malware, backdoors and suspicious files - Update WordPress, all plugins and themes to the latest version - Remove unused plugins and themes - Install a firewall (Wordfence, Sucuri or iThemes Security) - Activate two-factor authentication (2FA) for all admin accounts - Limit login attempts to a maximum of 3 per IP address
Our team at WP Maintainer does this daily. We know exactly where hackers hide their backdoors and how to remove every trace of a hack.
Step 6: Restore your reputation with Google
If Google has marked your website as unsafe, you must submit a reconsideration request via Google Search Console. This process can take 1-4 weeks. Make sure your website is completely clean before doing this.
Also check whether your SSL certificate is still intact and whether there are no suspicious redirects in your .htaccess file.
Step 7: Prevent a repeat
Preventing a hack is better than curing one. With a maintenance plan from WP Maintainer you are protected against future attacks: - **Daily malware scans** with immediate alerts on threats - **Proactive updates** of WordPress, plugins and themes - **Real-time firewall** that blocks suspicious traffic - **Daily backups** with 14-day retention - **SSL monitoring** every 30 seconds - **24/7 emergency help** for security incidents
Our plans start at €49 per month — a fraction of the cost of an average hack, which can cost €5,000 to €50,000 in direct damage and lost revenue.
Need immediate help?
Has your website been hacked? Do not wait. Every minute counts. Contact WP Maintainer directly via WhatsApp (+31 6 16073661) or email. We are available 24/7 for urgent security incidents and will help you restore your website quickly and safely.