Your business website was hacked: the first steps

A customer tells you your website sent them to a casino. Or Google shows strange pages in Japanese under your business name. Or Chrome puts up a red warning before anyone can reach your homepage.

Your website has been hacked. It's rarely personal: most website break-ins are automated, aimed at any site running an old plugin or a weak password. But your customers see your name on it, and Google may start warning them away until it's fixed.

Here's what to do, in order.

The first thirty minutes

1. Call whoever hosts or built the site. Your web host, your developer or the company that manages the site. Cleaning a hacked website is their job, and many hosts have a security team for exactly this. Ask them to take a backup of the site as it is now (for evidence), and to check whether other sites on the same account are affected.

2. Change every password connected to the site. In this order:

• The email account that can reset the others
• The hosting account and its control panel
• The website's admin logins, every user, not just yours. Delete admin users you don't recognize.
• FTP or file access and the database password, if your developer can do it
• The domain registrar account, where your domain name is registered

Turn on two-step sign-in wherever it's offered, starting with the hosting and registrar accounts. Whoever controls those controls your website and, often, your email.

3. Check your domain and email settings haven't changed. At the registrar, make sure the domain still points to your host, nothing has been transferred, and your email settings are unchanged. An attacker who reaches the registrar can redirect your email as well as your website.

Clean, then patch

4. Restore from a clean backup, or have it cleaned. If your host or developer has a backup from before the hack, restoring it is often fastest. Then everything must be updated, or the same hole lets them straight back in:

• The website platform itself (WordPress, for example)
• Every plugin and theme, and remove any you don't use
• Anything installed on the server that your host doesn't manage

Most website break-ins come through software that wasn't updated. See why software updates matter.

5. Check for anything that collects information. If your website takes payments or has forms, ask your developer to check the payment and form pages for added code. Code that copies card details as customers type them is a known attack on small online shops. If customers' card or personal details may have been taken, you may have duties to tell them; see Florida's data breach law, and if you take cards, call your payment provider.

Getting the Google warning removed

If Google has flagged the site, it says so in Google Search Console, under Security issues. If you haven't set up Search Console, verify your site there now; it's free.

Once the site is genuinely clean, open the Security issues report and choose Request a review, explaining what was removed and fixed. Google's advice is to make sure the problem is truly fixed first, because a review requested too early only keeps the warning up longer. (Google: Security issues report)

What we do, and what we don't

We don't build or host websites. Cleaning the site is for your host or developer. What we do is the part that usually let the attacker in: we secure the email accounts, passwords and computers your business runs on, set up two-step sign-in on the accounts behind your website and domain, and make sure the people with access still work for you.

What stops the next one

• Updates, every month. The platform, plugins and themes. If nobody owns this job, nobody does it.
• Fewer plugins, and none from unknown sources.
• Two-step sign-in on the hosting, registrar and website admin accounts.
• One login per person, removed the day they stop working with you. Former agencies and freelancers are a common way in.
• Backups kept away from the site, so a hack can't delete them too, and a restore you've actually tested.

What it costs, against what's at stake

	What it comes to
Our Essentials plan for five people	$375 a month. A help desk, a 24/7 security team on every computer, backups, and multi-factor authentication set up on your email.
A cleanup by your host or developer	Varies widely; ask before they start
A week of Google warning visitors away	Every customer who searched for you and turned back
If card or personal details were taken	Notification letters, a payment-provider investigation and possibly fines

Next steps

1. Find out today who controls your domain, hosting and website logins, and write it down.
2. Ask your developer when the site was last updated.
3. Book a free Security Check for the accounts and computers behind it.