If you are reading this because your website has just been hacked, take a breath. The site may be redirecting customers somewhere nasty, Google may be showing a red warning, or your host may have switched the whole account off. It feels like everything is on fire. In most cases it can be cleaned, the hole can be found and closed, and the site can go back to being something you do not have to think about every day.
This page is the starting point for all of it. It explains how to reach us quickly, what we do first, how to match what you are seeing to the right kind of help, and where to read more if you want to understand what happened. We are a WordPress team based near Kolkata, and we work with business owners in India, the USA and elsewhere.
Emergency help: how to reach us right now
The fastest way to get our attention is WhatsApp. Use the WhatsApp button on this site, and start your message with the word HACKED. That one word tells us to put your message ahead of routine work, because a hacked site is treated as urgent here. If WhatsApp is not convenient, use the contact form and put HACKED at the start of the subject or message.
In that first message, send what you can without hunting for it:
- Your website address.
- What you or your customers are seeing, in your own words. A screenshot helps.
- Whether you can still log in to WordPress and to your hosting account.
- Who your host is, if you know.
- Anything that changed recently: a new plugin, a theme update, a developer who left.
Do not send passwords in that first message. We will ask for access in a safer way once we know what we are dealing with.
What happens in the first steps
- We look at the site. From the outside first: what visitors see, what Google shows, whether the site is flagged.
- We tell you honestly what we see. If it looks like a hack, we say so. If it looks like a broken plugin rather than an attack, we say that too. We also tell you when we can start.
- We take a backup before touching anything. Even an infected site gets copied first, so nothing is lost if a step goes wrong and so there is evidence of how the attacker got in.
- We keep you updated on WhatsApp. You will know what has been found and what is being done, in plain words, without having to chase us.
A note on time zones for India and the USA
Our team works on Indian Standard Time. For owners in India, that simply means we are in the same working day as you. For businesses in the USA, the gap works in your favour more often than not: a problem you notice in your evening falls inside our working day, which often means work can start while you sleep. That is a description of how the clocks line up, not a promise about timing. We will always tell you when we can actually begin.
While you wait for us
The urge to start fixing things yourself is strong, and some of it is useful. A few actions help, and a few quietly make the cleanup harder.
Worth doing straight away:
- Change the password for your hosting account and your email, from a computer you trust. If the attacker has your email, they can reset everything else.
- Write down what you noticed and when. “Customers said the site jumped to a casino page on their phones on Tuesday” is more useful to us than you might think.
- Tell whoever else has access to the site, such as a former developer or a staff member, so nobody makes changes in parallel.
Best left alone until someone has looked:
- Deleting files or plugins at random. It rarely removes the infection, and it can destroy the clue that shows how the attacker got in.
- Restoring an old backup straight over the live site. If the backup was taken after the break-in, you bring the problem back, and you may overwrite recent orders or posts.
- Paying anyone who emails to say they hacked you and will stop for a fee. Talk to us first.
- Wiping the whole hosting account and starting again. Sometimes rebuilding is the right call, but it should be a decision, not a panic move.
Is your site on WordPress?
We are a WordPress team, and that is where our cleanup work is done. If you are not sure what your site is built on, that is fine; send us the address and we will check. If it turns out to be on another platform, we will tell you so honestly rather than take on work we are not the right people for.
What has happened to your site?
Hacks rarely announce themselves the same way twice. Find the description below that is closest to what you are seeing. Each one leads to a page about that specific problem and how we handle it. If several apply, that is common; pick the one that worries you most and we will look at the rest.
You need help immediately and do not know where to start
If you only know that something is badly wrong and you want a person on it, go to our emergency support for hacked websites. It covers what to do in the first minutes and what we do first.
Visitors are being sent to other websites
Customers say your site jumps to a gambling, dating or fake prize page, often only on phones or only when they arrive from Google. You may never see it yourself, because many redirects hide from logged-in owners. Our page on removing redirect hacks explains why that happens and how the injected code is found.
Google or your browser shows a red warning
A full-screen warning in Chrome, or a “this site may be hacked” line under your listing, means Google has flagged the site. Cleaning the site is half the job; the other half is the review request. See getting off Google’s blacklist.
Strange pages in Google that you never wrote
A search for your domain shows pages about pills, casinos, replica goods or text in Japanese. That is injected SEO spam, and some of it is only shown to search engines. Our spam page cleanup service deals with the pages and the code that creates them.
Once the site is clean, those addresses can linger in search results for a while. Clearing them out properly is its own task, covered in removing hacked URLs from Google search.
Your online store has been hit
If you run WooCommerce, a hack touches orders, customer accounts and payment plugins, and you probably cannot afford to close the shop for long. Read about repairing a hacked WooCommerce store.
If customers report fraud on their cards after buying from you, or the checkout page looks slightly different, a card skimmer may be stealing payment details. That needs urgent attention: finding and removing checkout skimmers.
You cleaned it, but it came back
The malware disappears for a few days and then returns. That nearly always means something was left behind. Two pages cover this from different sides: hunting down hidden backdoors and web shells, and our help for sites that keep getting reinfected.
Odd scripts in your posts, or settings you did not change
Some infections live in the database rather than the files: script tags inside old posts, poisoned options, piles of spam comments, or users you never created. See cleaning malware out of the WordPress database.
You cannot log in any more
Your password no longer works, your admin account has vanished, or there are new administrators you do not recognise. Our page on getting your WordPress admin back explains how access is restored without making things worse.
Your homepage has been replaced
Instead of your business, visitors see a message, a flag or a slogan left by the attacker. That is defacement. Read about restoring a defaced website.
Your host or registrar says you are hosting phishing
You receive a notice saying a fake bank or email login page is sitting somewhere on your site, sometimes with a deadline before the domain or account is suspended. See taking down phishing pages hidden on your site.
Your hosting account has been suspended
The site shows a suspension page, or the host has quarantined files and asked you to clean up. Working with the host’s support team is part of the fix. Our page on accounts suspended for malware covers what that involves.
Your domain is sending spam email
Bounce messages arrive for emails you never sent, your host warns about outgoing mail, or your own messages land in spam because the domain or server is blocklisted. Read stopping a website from sending spam.
Antivirus software blocks your site
Google shows no warning, but customers say their antivirus, a browser extension or their office firewall will not let them open your site. That is a different set of lists and a different process: when security vendors flag your site.
You need to know how it happened
Perhaps an insurer, a client or your own board wants an explanation, or you simply want to know what the attacker touched. See our hack investigation and written report.
You are an agency with a hacked client site
If you build or look after sites for clients and one of them has been compromised, we can do the cleanup quietly under your name. Read about white label hack cleanup for agencies.
If you are in the USA or India and want to know how working with us looks from where you are, the two sections further down are for you.
How we handle a hacked website, step by step
Whatever the symptom, the work follows the same order. The core of it is our WordPress malware cleanup; the pages above add whatever a particular problem needs on top.
- Backup first. We copy all files and the database before changing anything. If the site is still serving malware to visitors, we may also put it behind a holding page while we work, and we will tell you before we do.
- Find every infection, not just the visible one. The redirect or spam page you noticed is usually the symptom. We check files against clean copies of WordPress core, look through plugins and themes, search the uploads folder for code that should not be there, and go through the database for injected scripts and rogue users.
- Close the entry point. A cleanup that leaves the door open is a cleanup that will be repeated. We look for how the attacker got in, which is often an out-of-date plugin, a nulled theme, a reused password or another site on the same hosting account, and we fix that cause.
- Deal with warnings and blacklists. If Google, a browser, an antivirus vendor or your host has flagged the site, we request reviews once the site is clean and follow them through.
- Harden what is left. Passwords and security keys are changed, unused plugins and accounts are removed, and sensible protections are switched on so the same trick does not work twice.
- Give you a report. You get a short written summary of what was found, what was removed, how it most likely got in, and what we recommend next. It is written for a business owner, not for a security conference.
We will not tell you a site is clean until we have checked it, and if we find something we cannot fix, or a problem that is not a hack at all, we will say so plainly.
Hacked website help for businesses in the USA
Plenty of American small businesses run on WordPress with a mainstream host and no developer on call. When something goes wrong at the end of the working day, finding someone who will actually look at it can be hard. Working with a team in India changes that pattern: your evening is our day, so the investigation can be underway before you are back at your desk.
We communicate in English, on WhatsApp or by email, whichever you prefer. Payment from outside India is possible by PayPal or Wise. We work with whichever host you are on, including the large US shared hosts, and we can talk to your host on your behalf if that helps. If customer data may have been exposed, we can explain in general terms what notification rules exist, but that is general information, not legal advice. Read more on our page for hacked website repair for US businesses.
Hacked website help for businesses in India
For Indian owners, the practical side is simpler: same time zone, WhatsApp first, and no need to write a formal email if you would rather send a voice note. If explaining the problem in English is a strain, tell us in Hindi or Bengali and we will take it from there.
Many Indian sites sit on low-cost shared hosting where several websites share one account and nobody is watching the server, which makes it easy for an infection to spread from one site to the next. We know how those panels work and what the hosts will and will not do for you. CERT-In is the national agency for cyber security incidents in India, and we can point you to it if your situation calls for it. More on our page for hacked website repair in India.
Understand what happened: guides
If you want to understand the problem, or you are the kind of owner who likes to know exactly what is being done to your site, these guides explain each part in plain language.
Spotting a hack and the first hour
- The signs owners actually notice: the small oddities that usually come before a full-blown warning.
- A first-hour checklist after a hack: what to do, and the two or three things that make matters worse.
- Is it your email or your website? How to tell a compromised mailbox from a hacked site, because the fixes are different.
- Emails that say “we hacked your site, pay us”: how to tell a real threat from a bluff.
- Our step-by-step guide to cleaning a hacked WordPress site yourself, for owners who want to try it first.
How attackers get in
- How websites actually get hacked: the common entry points, without the jargon.
- What a plugin vulnerability is, how it gets found and patched, and how to check the plugins you run.
- Why “free premium” themes and plugins carry malware so often.
- SQL injection and cross-site scripting in plain words, for owners who keep seeing the terms.
- How one hacked site infects its neighbours on the same hosting account.
- Is your host responsible? What hosting companies usually do, and what they leave to you.
Finding the malware
- Scanning a website for malware: the tools you can use yourself, and what scanners routinely miss.
- PHP files in the uploads folder, and why finding one is a red flag.
- Checking WordPress core files against official checksums to see what has been altered.
- Found an admin user you did not create? What it means and what to check next.
- Using activity and server logs after a hack to see what the attacker did and when.
Specific hacks and Google warnings
- Why a WordPress site starts redirecting to spam, and where the redirect code tends to hide.
- The Japanese keyword hack and other injected SEO spam, explained.
- The “this site may be hacked” label in search results, and how it gets removed.
- The red “deceptive site ahead” screen in Chrome and what triggers it.
- Reading the Security Issues report in Search Console, and how it differs from a manual action.
After the cleanup
- When restoring a backup is enough, and when it quietly brings the hole back.
- Getting rankings and traffic back once the site is clean.
- Who you may need to tell after a breach, in general terms, not legal advice.
- A one-page incident plan to write before the next problem rather than during it.
Staying safe afterwards
A cleaned site is not a protected site. The same out-of-date plugin, the same shared password or the same unattended admin account will let someone back in, and the second cleanup is no more pleasant than the first. What keeps a site clean is boring, regular work.
- Updates applied promptly, with a backup taken first and the site checked afterwards.
- Dated backups kept off the server, so there is something clean to go back to.
- Logins protected properly. Setting up two-factor authentication on WordPress blocks logins that rely on a stolen password alone.
- A filter in front of the site. Our guide to how a website firewall works explains what it blocks and what it cannot.
- Someone watching for changes, so a new infection is caught in days rather than months.
Our ongoing security maintenance plan does that work for you, and it is optional; plenty of owners prefer to handle it themselves after a cleanup. If that is you, start with our list of security habits for small business websites and work through it at your own pace.
And if your site is hacked right now, you do not need to read any further. Send us a WhatsApp message that starts with HACKED, and we will take a look and tell you honestly what we see.
Latest guides on hacked websites
- Signs Your Website Has Been Hacked: What Owners Notice
- Website Hacked? What to Do First (and What Not to Do)
- How Websites Get Hacked: The Common Ways In
- Nulled Plugins and Themes: Why They Carry Malware
- How to Scan a Website for Malware (and What Scans Miss)
- Unknown Admin User in WordPress: What It Means
- Search Console Security Issues Report, Explained
- Website Hacker Extortion Email: Real Threat or Bluff?
- Is Your Web Host Responsible for a Hacked Website?
- Shared Hosting Cross-Site Infection: Why Hacks Spread
- Restoring a Backup After a Hack: When It Is Enough
- Notify Customers After a Website Breach: Who to Tell
- SEO Recovery After a Website Hack: Getting Traffic Back
- PHP Files in WordPress Uploads: Why It Is a Red Flag
- WordPress Core File Integrity Check With Checksums
- Website Security Incident Plan: A One-Page Template
- Hacked Email vs Hacked Website: How to Tell Which
- WordPress Activity Logs After a Hack: What They Show
- WordPress Plugin Vulnerabilities Explained
- SQL Injection and XSS Explained for Website Owners