The message arrives through your contact form or straight to your inbox. It says your website has been hacked, that the sender has copied your database, and that unless you pay in Bitcoin within a set number of hours they will leak your customer list, wreck your Google rankings or take the site offline. It may even appear to come from your own email address.
Your stomach drops. Before you do anything else, know this: many of these emails are bluffs sent in bulk to long lists of site owners. Some are not. This post explains how to tell the difference, what to do in either case, and what not to do while you are still rattled.
The kinds of threatening email site owners receive
They all try to make you act fast, but they come from very different places.
The mass-mailed bluff
This is the most common. One template goes out to addresses scraped from websites by the thousand. It claims a hack in vague terms, names no files and shows no data, and demands a payment to a cryptocurrency wallet. Nothing has happened to your site. The sender is betting that enough frightened people will pay without checking.
The “we will destroy your SEO” threat
A variation says that unless you pay, the sender will point spam links at your site, file fake complaints or flood it with traffic. It does not claim to be inside your site at all. It is a threat about the future, and it is designed to sound technical.
The spoofed “from yourself” email
The email shows your own address in the From line, and the text says this proves the sender has control of your account. It proves nothing of the kind. Forging the visible sender of an email is easy when a domain’s email authentication is not set up to reject it. It is the digital version of writing a false return address on an envelope.
The “security researcher” asking for a reward
A politer message says the sender found a “critical vulnerability” on your site and asks what bounty you pay before they share details. Often the “vulnerability” is something minor, such as a missing email record or a page header, found by an automatic scanner. It is not extortion in the usual sense, but it uses the same pressure. You owe nothing to someone you never asked to test your site.
The real one
Occasionally the threat is genuine. The sender includes specific proof: a list of your actual customer names and emails, a screenshot of your dashboard, the names of files on your server, or a sample of order data. This usually means the site, the database or a connected account really was breached, and the message is the attacker trying to make money from it.
How to tell a bluff from a real breach
Read the email again slowly, as if it were addressed to somebody else. Then ask these questions.
- Is there evidence specific to you? Your domain name pasted into a template is not evidence. Real data from your database is. A screenshot of your own admin area is. If all you have is claims, it is most likely a bluff.
- Is any of the “proof” public? An email listing your address, phone number and the names on your About page has only read your website. Anyone can do that.
- Does a password appear? Some emails quote an old password to seem convincing. That password usually comes from a leak at another service, not from your website. It is still a reason to change it everywhere you reused it.
- Does the site show signs of tampering? Look for the symptoms covered in our post on the signs a website has been hacked: strange admin users, unexpected redirects, spam pages in Google, or a warning from your host.
- Do your logs or security plugin show anything? A login from an unfamiliar country, a burst of requests to one file, or new files appearing around the time the email arrived are all worth noting.
Search for a distinctive sentence from the email in quotes on a search engine. Mass-mailed templates are often posted on forums by other recipients, and finding the same wording there tells you a lot.
What not to do
The first hour is when people make the choices they later regret.
- Do not pay. Paying buys you no certainty at all. A genuine attacker who has your data can still leak it, ask for more, or sell it anyway, and a bluffer now knows you are someone who pays.
- Do not reply. A reply confirms your address is read by a real person who is worried, and it invites follow-up pressure. If the email reached you through your contact form, the sender may not even see a reply.
- Do not click links or open attachments. Some of these messages are a vehicle for phishing or malware. The “proof” file is sometimes the actual attack.
- Do not delete the email. Keep it, including its full headers, in case you need to report it or it turns out to be real.
- Do not start deleting files on the server in a panic. If there is a genuine breach, you will destroy the evidence of how it happened.
Check the email headers
Most email apps let you view the original message or the full headers. You do not need to understand every line. Look for two things.
First, the “Received” lines near the top of the header trace the servers the message passed through. If an email claiming to be from your own account came from a server nothing to do with your provider, the From line was forged.
Second, look for results labelled SPF, DKIM and DMARC. A “fail” on these for a message showing your own address means the sending server was not authorised to send for your domain. That is a sign of spoofing, not of your mailbox being taken over.
If spoofed emails using your domain keep arriving, the fix is in your domain’s email authentication records, not in your website. Our business email setup service covers SPF, DKIM and DMARC for that reason.
If it looks like a bluff
Even when you are fairly sure it is a template, spend half an hour making sure you are right, and use it as a nudge to tidy things up.
- Change the passwords for your WordPress admin, hosting panel and the email account linked to the site, especially if the message quoted any password you have used.
- Switch on two-factor authentication for every administrator.
- Check the list of WordPress users for any administrator you do not recognise.
- Confirm you have a recent backup stored off the server.
- Block the sender in your email and, if the message came through your contact form, consider adding a spam filter to the form.
Then let it go. Bluff emails often return later with fresh wording, and the right response each time is the same.
If it looks real
When the sender has shown real data, treat it as a security incident rather than an email problem.
- Preserve evidence. Save the email with headers, take a full backup of the site files and database as they are now, and ask your host to keep the server access logs for the period.
- Work out what the data could have come from. Customer names and emails might come from the WordPress database, a form plugin’s stored entries, a mailing list service or an email account. The source determines where the hole is.
- Find the entry point. The attacker got in somewhere: an outdated plugin, a stolen password, a leftover file. Closing that is what stops the next breach.
- Clean the site properly once you know what you are dealing with, then change every password and the WordPress security keys.
- Consider your notification duties. If personal data about customers was taken, the law where you and they are based may require you to tell them or a regulator. That depends heavily on the country and the data involved. Our post on notifying customers after a website breach gives general information, not legal advice. Talk to a lawyer for your specific situation.
Working out exactly how someone got in, and what they touched, is the job of an investigation rather than a quick cleanup. Our website hack investigation page describes what that involves and what kind of written report you get at the end.
Reporting extortion
Extortion is a crime in most countries, and reporting it creates a record even if nobody is caught. In India, the government’s National Cyber Crime Reporting Portal at cybercrime.gov.in accepts complaints, and your local police cyber cell can also take one. In the United States, the FBI’s Internet Crime Complaint Center at ic3.gov collects reports of online extortion. Elsewhere, your national police or cybercrime agency will have its own route.
When you report, include the email with headers, any wallet address mentioned, the amount demanded and the time the message arrived. Do not expect a fast response, but do expect the information to be useful if the same sender has targeted others.
Making the next one easier to ignore
The best defence against this kind of pressure is knowing your site’s state without having to guess. If you have current backups off the server, a list of who has admin access, updates applied, and someone checking the site regularly, a threatening email becomes something to check calmly rather than a crisis. The website security best practices guide covers the routine that gets you there.
If the email has left you unsure whether anything is actually wrong, we can look. The hacked website help page explains how we work: message us on WhatsApp, start with the word HACKED, forward the email or a screenshot, and we will tell you honestly whether we see signs of a real breach before suggesting any work.
Next in this series: Is Your Web Host Responsible for a Hacked Website?
