You opened your website a few minutes ago and something is wrong. Maybe a customer sent a screenshot of a gambling page, maybe your host emailed about malware, or maybe the login screen simply rejects a password you have used for years. Your heart rate is up and you are not sure who to call.
This page is about that moment, and about what happens when you hand the problem to us. For the wider view of how we put compromised sites right for owners in India and the USA, start with our main hacked website repair page. Here, the focus is narrower: how to reach us quickly, what to tell us, and what we do in the first stretch of work before any cleaning begins.
The quickest way to reach us
Open WhatsApp and make HACKED the very first word you type. When we see it, your message moves ahead of anything routine in the queue. Hacked sites are treated as urgent and handled ahead of maintenance tasks, small edits and design requests.
If WhatsApp is not an option for you, the contact form and phone work too. WhatsApp is simply the channel we watch most closely during working hours, and it lets you send screenshots and short videos, which often explain the problem faster than words.
We will not promise a reply time, because we would rather be honest than impressive. What we can commit to is this: a HACKED message is read as an emergency, and our first answer is an honest account of the site and of our availability.
What to put in your first message
A good first message saves a round of questions. You do not need technical words. Write it the way you would describe it to a friend:
- Your website address, exactly as customers type it.
- What is going wrong, in your own words. “Phone visitors land on a casino site” is perfect.
- When you or a customer first noticed it.
- Anything you have already tried, such as changing a password, deleting a plugin or asking the host for help.
- Whether the site takes orders, bookings or payments.
- Who controls the hosting account: you, a developer, or someone you can no longer reach.
Leave passwords out of that first message. Once we have agreed on the work, we will suggest a safer way to share access, and you can change every password afterwards anyway.
What we do before cleaning anything
The first stretch of an emergency is not about deleting malware. It is about seeing clearly, protecting what you have, and stopping the harm to visitors. Rushing straight into deleting files is how evidence gets lost and sites get broken.
We look from the outside first
Before we ask for a single login, we visit your site the way your customers and Google do. We check it on a desktop browser and as a phone, arriving directly and arriving from a search result, because many infections only show themselves to certain visitors. We look for browser warnings, odd redirects, injected links and pages that should not exist. This outside view usually tells us what kind of problem we are dealing with.
We give you a straight answer
Then we reply. You get a plain description of the evidence, what it probably means, and how soon we can realistically begin. If the evidence points to something serious, such as a checkout that may be capturing card details, we say so directly. If it looks smaller than you feared, we say that too. You decide whether to go ahead.
We take a backup before touching a single file
Once you give us access, the very first action is a complete copy of the site: every file and the full database, stored away from the live server. It may seem odd to back up a hacked site. It is not.
That copy protects you if something goes wrong during the cleanup, it preserves the evidence of how the attacker got in, and it means a legitimate file we have to remove can always be brought back. If you already keep backups, keep them, and tell us where they are. Ours is an extra snapshot of the site exactly as we found it. Our guide to backing up a WordPress site properly explains why dated copies matter so much in situations like this.
We contain the damage
With the snapshot safe, we stop the harm that is still happening. Depending on what we find, that can mean switching off a malicious redirect, putting up a temporary holding page so visitors are not sent to a scam, disabling a payment step that looks tampered with, or blocking a rogue admin account. Containment is a pause, not the fix. It buys time to clean properly without your customers being hurt in the meantime.
We lock the attacker out
Next comes access. Together with you, we change the passwords for WordPress admin accounts, the hosting panel, FTP or SFTP, and the database. We remove admin users nobody recognises. If you have been locked out of your own dashboard, our admin access recovery service explains how that part is handled.
Only then does the real cleanup start: removing infected code, finding backdoors, closing the hole that let the attacker in, and checking the site from every angle again. That deeper work is described on our WordPress malware cleanup service page.
While you wait for our reply
There are a few calm things you can do in the meantime. None of them are required, and none of them should be rushed.
- Write down what you saw. Times, screenshots, what the customer said. Details fade quickly.
- Check your email for host notices. Hosts often send a message about malware or unusual activity before suspending anything, and it may name specific files.
- Find your logins. Hosting, domain registrar, WordPress. If someone else holds them, ask them now.
- Tell your team. Anyone who handles orders or customer messages should know, so they can answer questions consistently.
For a fuller do-it-yourself list of first steps, written for owners rather than about our service, read what to do in the first hour after a hack.
What to avoid in the first hour
Panic produces a few predictable mistakes. Each one makes the cleanup longer or harder.
Deleting everything that looks strange
WordPress has thousands of files, and many legitimate ones have odd names. Deleting by guesswork can break the site, and it destroys the trail that shows how the attacker got in. Without that trail, the hole often stays open.
Restoring an old backup on top of the live site
A restore feels like a reset button, but the backup may already contain the infection if the hack started weeks earlier. Even a clean backup brings back the same outdated plugin or weak password that let the attacker in. Restoring can be part of the solution, but only once someone knows what happened.
Installing several security plugins at once
Two or three scanners running together can conflict, slow the site down or lock you out. One careful scan, read by someone who understands it, is worth more than a pile of overlapping alerts.
Paying anyone who emails a threat
If you have received a message demanding payment to stop an attack, do not reply or pay. Forward it to us along with your other details. Many of these emails are bluffs sent to thousands of site owners, and paying does not make a real attacker leave.
How we keep you updated
An emergency is stressful partly because you cannot see what is happening. So we narrate it. You get short WhatsApp messages at each stage: when the backup is done, when the immediate threat is contained, what we found, and when the site is clean. You can read them whenever it suits you; there is no need to sit and watch.
Before any step that changes how your site looks or behaves for customers, such as removing a plugin you rely on or replacing a theme file, we ask first. You stay the owner throughout. We never hold your site, your logins or your data back from you.
When it is not actually a hack
Some emergencies turn out to be something else. An expired domain, a broken plugin update, a hosting outage or a DNS change can all look alarming. If that is what we find during the first look, we tell you and point you to the right fix rather than selling you a malware cleanup you do not need. If you are unsure whether you have been hacked at all, our guide to the symptoms owners usually notice on a compromised site can help you tell the difference.
Once the emergency is over
When the site is clean, the pressure drops, and it is tempting to move on. Take a few minutes first. You receive a brief write-up covering the infection, the clean-up, our best guess at the entry point, and the fixes that will keep it shut. Often the advice is simple: remove an abandoned plugin, keep updates current, turn on two-factor login, and keep dated backups somewhere other than the server.
If your host suspended the account, we also help you reply to them and get the site back online; that situation has its own page on dealing with a malware suspension from your host. And if Google or a browser flagged the site during the attack, clearing that warning becomes part of the same job.
If the damage is live as you read this, skip the rest of the page. Send a WhatsApp message that starts with HACKED, include your website address, and we will take it from there.