Emergency

Hacked website: what to do in the first hour

Published on 22 October 2026 · David Serreau

Home page replaced, redirects to an unknown site, a “dangerous site” warning in Google, emails sent without your knowledge: these are signs of a hack. The order of the steps matters as much as the steps themselves.

Right away

• Isolate: if you can, take the site offline (maintenance mode) or alert your host so they can act.
• Keep the evidence: dated screenshots, server and hosting logs, a full copy of the site in its hacked state. Do not start by deleting everything.
• Change passwords from a clean device: hosting, site admin, FTP, database, email.

Then

• Assess the damage: what data may have been copied or destroyed (customers, orders, accounts)?
• Personal data involved? In the EU, a business must notify the data protection authority (the CNIL in France).
• Report it to the police, with the evidence. In France, cybermalveillance.gouv.fr guides victims; elsewhere, your national cybersecurity agency.
• Find the way in (outdated plugin, weak password, forgotten account) and close it. Otherwise the site will be hacked again.
• Go back online only after fixing the flaws and changing every password.

What not to do

• Restore a backup without finding the flaw: the door stays open.
• Delete suspicious files before keeping a copy: the evidence disappears.
• Pay a ransom or answer a blackmail message.

To keep it from happening

Regular updates of the site and its plugins, strong and different passwords, limited admin access, dated backups kept off the server.

Sources

checked on 22 October 2026

• Cybermalveillance.gouv.fr (French government), “Defacement” response sheet, in French