Website Hacked? The Complete Recovery Guide (Step by Step)

That sinking feeling when your website shows a pharmacy page, redirects visitors to spam, or Google flags it with a red warning screen: thousands of site owners face it every day. The good news is that almost every hacked website can be fully recovered. The bad news is that every hour you wait costs you traffic, trust and sometimes rankings. Here is the exact process professionals follow.

First hour: contain the damage

1. Take the site offline or enable a maintenance page. Every minute it serves malware, you lose visitor trust and risk a Google blacklist.
2. Change every password. Hosting panel, FTP or SSH, database, CMS admin and your email. Assume all of them are compromised.
3. Contact your host. Good hosts can isolate the account, share access logs and sometimes restore clean snapshots.
4. Do not delete anything yet. Logs and infected files reveal how the attacker got in. Wipe them and you may never close the hole.

Find and remove the infection

Most infections fall into a few patterns: injected scripts in theme or core files, rogue admin users, malicious cron jobs, and backdoor files with innocent names dropped into upload folders.

• Compare core CMS files against a fresh download. Anything modified is suspect.
• Check for files changed in the last 30 days, especially PHP files inside upload directories where no PHP should exist.
• Review the users table for admins you did not create, and the crontab for scheduled tasks you do not recognise.
• Scan the database for injected script tags and spam links in posts and options tables.
• Restore from a clean backup when one exists, then patch the entry point before going live. A restore without patching gets reinfected within days.

Recover your Google standing

If Google flagged the site, open Search Console, go to Security Issues, confirm the cleanup and request a review. Most reviews clear within 72 hours. Rankings usually recover within a few weeks once the warning is lifted, provided the cleanup was complete. Half-done cleanups are the main reason warnings come back.

Prevent the next attack

• Update CMS, themes and plugins weekly. Outdated plugins cause the majority of CMS hacks.
• Use a web application firewall and limit login attempts.
• Enforce strong unique passwords and two-factor authentication for every admin.
• Keep daily off-server backups with at least 30 days of retention.
• Remove unused themes, plugins and admin accounts. Less surface, less risk.

When to call professionals

If the infection returns, the site handles payments or customer data, or you simply cannot find the entry point, get expert help. Our managed hosting and security team handles cleanup, hardening and monitoring, and our SEO team repairs ranking damage afterwards. Get emergency help here.

Frequently asked questions

How long does hacked website recovery take?

A straightforward cleanup takes a few hours to a day. Complex infections with database injections and blacklist reviews typically take 2 to 5 days including Google's review time.

Will my Google rankings recover after a hack?

Usually yes. Once the security warning is lifted and the spam content is removed, most sites return to prior positions within 2 to 6 weeks. Speed of cleanup is the biggest factor.

Should I just delete the website and start over?

Rarely. A rebuild loses your content, links and rankings, and if you reuse the same passwords and plugins it gets hacked again. Clean, patch and harden instead.