When Your Homepage Is No Longer Yours
A customer sends you a screenshot. Where your homepage used to be there is a black background, a hacker’s alias in large letters, maybe a flag, a slogan or a line like “hacked by” followed by a name you have never seen. Sometimes music plays. Sometimes it is only one page that has changed, and the rest of the site looks normal.
This is a defacement. It is the loudest kind of website attack, and it is meant to be seen. The good news is that a defacement is usually easier to spot and reverse than a quiet infection. The bad news is that the person who did it had enough access to change your files or your content, and that access does not disappear when the message does. If you want the wider picture of how we handle a compromised site, start with our main hacked site repair page. This page is about putting your real site back in front of visitors and making sure the vandal cannot return.
What a Defacement Actually Is
Most defacements are not personal. They are often done by people who scan the internet for sites running a known vulnerable plugin, theme or old script, break in automatically, and drop their message so they can claim the site in a public defacement archive or a group chat. Your business was rarely chosen; it was found.
On a WordPress site, the change usually happens in one of three places:
- A new file at the top of the site. An attacker uploads an index.html file to the main folder. Many servers serve index.html ahead of WordPress’s index.php, so the hacker’s page appears and your real site is still sitting behind it, untouched.
- Edited theme files. The header, footer or homepage template is rewritten to print the message, or to load it from another server.
- Changed content in the database. The homepage, or every post, has its text replaced through the WordPress editor or a direct database write. The site title and tagline may be changed too.
Which one happened makes a big difference to how much of the site has to be repaired, and how much of your content can be kept exactly as it was.
Why You Should Not Just Restore Last Week’s Backup
The obvious move is to restore a backup and move on. Sometimes that is right. Often it is not the whole answer, for two reasons.
First, the attacker almost always got in before the defacement appeared. They may have been inside for days, leaving a backdoor so they could come back. A backup from the day before the message went up can still contain that backdoor, and the same group can deface the site again the moment it is restored. Our post on restoring a backup after a hack explains how to tell when a backup is safe to use.
Second, restoring brings back the hole they used. If the defacement came through an outdated plugin, restoring a copy that includes the same plugin version restores the open door too.
So we use backups, but carefully. A clean backup is a source of good content and files, not a reset button.
How We Restore a Defaced Site
Preserve the evidence first
We take a full copy of the site exactly as it is, defacement included. That copy shows which files changed and when, and it is what you would need if you want to report the incident or pass details to your host. It also means nothing we do afterwards is irreversible.
Get the message off the screen
Visitors and customers should not keep seeing the attacker’s page while the deeper work goes on. Where the defacement is a single dropped file, removing it can bring your site back almost at once. Where theme files or content were changed, we put up a plain maintenance notice instead, served with the correct status code so search engines understand it is temporary. Our guide to WordPress maintenance mode explains why that status code matters.
Find every change, not just the visible one
We compare WordPress core files with the official copies, compare your theme and plugins with clean versions of the same releases, and look for recently modified files across the site. In the database we look for replaced content, changed site settings and new users. A defacer who could change your homepage could also have added a script to every page, so we check for that rather than assuming the message was the only change.
Rebuild from clean sources
Core files, plugins and themes are replaced with fresh copies from their official sources. Your own content, images and custom code are restored from the newest backup we can confirm is clean, or repaired in place if no clean backup exists. If a page was overwritten in the database, WordPress post revisions sometimes still hold the original text, which can save you retyping it.
Close the entry point
We work out how they got in, as far as the logs allow. That might be an abandoned plugin, a weak FTP password, an old copy of the site in a subfolder, or a hosting account shared with another site that was already compromised. Fixing that is what stops the same alias reappearing on your homepage. Where the trail involves hidden scripts, our backdoor removal work goes hand in hand with this, and the cleanup itself is part of our WordPress malware removal service.
The Search Results Problem
If Google crawled your site while it was defaced, the hacker’s message can show up as your page title or description in search results. People searching for your business name may see “hacked by” next to your logo.
Once the real site is back, the fix is to let Google see it again. In Google Search Console, the URL Inspection tool lets you test the live homepage and request indexing, which asks Google to crawl it again. It does not happen instantly, and Google decides when to refresh the result, but it is the right first step. If Google also flagged the site as harmful, the Security Issues report in Search Console will say so, and a review needs to be requested after the cleanup. Our Google blacklist removal page covers that process, and if spam pages were added during the attack, removing hacked pages from Google deals with clearing them out of the index.
What to Do While You Wait
- Take screenshots of the defaced page. Note the date and time, and copy any names, email addresses or links the attacker left. These are useful to you, your host and anyone investigating.
- Do not log in from a computer you suspect is infected. If staff computers have been acting oddly, use a different device.
- Change your hosting and FTP passwords. Do this from a clean device. It cuts off one of the common ways defacers keep access.
- Do not reply to or contact the attacker. Defacers sometimes leave a contact handle. Engaging gains you nothing and can invite another round.
- Tell your team what to say. If customers ask, a short, calm answer works: the site was vandalised, it is being repaired, and no action is needed from them unless you later learn otherwise.
If the defacement included a message claiming that customer data was taken, take that seriously but do not assume it is true. Defacers often exaggerate. Part of our work is checking whether there is any sign that data was actually accessed, and if you need to think about informing customers, our post on notifying customers after a breach sets out the general points to consider. That post is general information, not legal advice.
When a Site Is Defaced Again and Again
If you have already cleaned the same defacement more than once, that pattern nearly always means one of three things: a backdoor was missed, the vulnerable software was never updated, or the hosting account itself is still open to the attacker. Removing the message again will not help. The cleanup has to start from the assumption that the attacker still has a way in, and the job is to find it. If this is where you are, say so when you contact us so we plan for a deeper look from the start.
Getting Help With a Defaced Website
A defaced homepage moves ahead of routine work in our queue. Put HACKED as the opening word of a WhatsApp message to us, then add the site address and a screenshot of what visitors see if you have one. The contact form and phone are there as well.
Our first step is a look at the site, followed by a plain answer on what has happened and when work can begin, and nothing is touched until a full copy is saved. While we work, we keep you updated on WhatsApp so you know when the message is gone, when the real site is back, and what was done to stop it happening again. Owners in the USA can read how the time difference works on our page for US businesses.