Hacked site emergency kit

If you just noticed a hack, do these things in order. Do not wipe the site before you have a copy. The copy is how you learn what happened, and it is how a cleanup avoids deleting the wrong file.

Do this

1. Ask the host for a snapshot, or download files and a database dump yourself if the host has not suspended you.
2. Turn on a maintenance page if you can, so visitors stop hitting the spam.
3. Change the password for hosting, DNS, SFTP, and the CMS admin from a clean computer. Do this at the registrar too if DNS changed.
4. Open Google Search Console and read the security issues report. Do not request a review until the spam is gone.
5. Write down what you see: redirect, unknown user, warning text, and when you noticed it.

Do not do this

• Do not delete random PHP files because the name looks odd. Some belong to the host or to a plugin.
• Do not reinstall WordPress over the top and call it done. The database and the uploads folder often keep the spam.
• Do not pay a stranger who emailed you claiming they found the hack.

Who to contact

Your host’s abuse or support desk, the registrar if nameservers changed, and Google Search Console for the warning. Laskyr is optional: cleanup is $499 after you confirm you own the site.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds