What to do if your website is hacked: the first steps, who to call and how to recover

How you usually find out

Most owners don't discover a hack by looking at their own homepage. They hear about it. A customer mentions being sent to a strange site, a Google result for your business shows "This site may be hacked" or "This site may harm your computer", or Chrome puts a full-page warning in front of your site. If you've verified your site in Google Search Console, Google says you should also get an email warning that the site is suspected of being hacked.

Other signs are quieter: pages you didn't write turning up when you search Google for site:yourdomain.com.au, an admin user nobody recognises, files changed on dates when nobody worked on the site, or your enquiry form suddenly sending junk.

Don't take "it looks fine on my screen" as the all-clear. Google says many hackers make changes that are "visible only to Google machines", and that they "often attack only specific user-agents or referrers to avoid detection". So the spam or redirect might only appear for someone arriving from a Google search on a phone. Google also warns against opening infected pages in your own browser, because malware often spreads through browser weaknesses. Its URL Inspection tool lets you see a page as Google sees it without that risk.

The first hour: lock the doors from a clean device

The aim of the first hour is to stop it getting worse and keep enough evidence to work out how it happened. Resist the urge to start deleting things before someone has looked.

Change passwords from a computer or phone you trust, not the one you were using if you suspect it's infected. Australia's cyber security agency puts it simply: "If you need to change your passwords, use a device that is free from malware." Start with the accounts that control everything else, and turn on multi-factor authentication wherever it's offered.

• Website admin: change every admin password and remove any admin user you don't recognise. Note their names and creation dates first.
• Hosting account and server access: change the hosting login and any FTP, SFTP or database passwords, or ask whoever manages hosting to do it.
• Domain registrar: change the password and check the DNS settings haven't been altered to point your domain somewhere else.
• Email: change the password on any mailbox used to log in to the site or reset its passwords, since whoever controls that inbox can take the site back.
• Evidence: write down when you first noticed, what you saw and which URLs were affected, and take screenshots. Your developer, your host and any report will ask for it.
• If the site is actively sending visitors to malware or a fake login page, ask your host or developer to take it offline or show a maintenance page until it's clean.

Keep readingKeep your website logins in your business's name

Who to call

Call whoever built or manages your site and your hosting provider first. They hold the server access and backups, and the fix will run through them. If you don't know who has those logins, that's the first thing to sort out.

For help and to report it, the Australian Cyber Security Centre runs a hotline on 1300 CYBER1 (1300 292 371), 24 hours a day, seven days a week. It says it can connect you with support services and guide you through reporting a cybercrime to police through ReportCyber. It also says it can't provide technical support for your device, so it won't clean the site for you.

The ACSC's separate cyber security incident form is for organisations with 250 or more staff or an annual turnover of at least $250 million, government departments, critical infrastructure and other regulated entities. If that isn't you, ACSC says you may need to report it as a cybercrime instead, and to call the hotline if you're unsure. Whichever you use, it warns: "Do not submit a report using a network you believe is compromised."

Check whether customers' details were exposed

This is the part owners tend to skip. Your website probably collects names, phone numbers, email addresses and job details through its enquiry form, and some sites store every submission in a database. If an attacker had admin or server access, assume they could see those records until your developer can show otherwise. Find out what the site stored, for how long, and whether the access logs show it was viewed or downloaded.

Whether the law requires you to notify anyone depends on your business. The Notifiable Data Breaches scheme applies to businesses with an annual turnover of more than $3 million, plus some smaller ones, including private health service providers, credit providers, businesses that trade in personal information and, for tax file numbers, anyone holding them. Most small businesses with $3 million or less in turnover aren't covered.

If you are covered, the OAIC says your first step should be to "contain the breach where possible and take remedial action". You then have to take all reasonable steps to assess a suspected breach within 30 calendar days. A breach is notifiable when it's likely to result in serious harm to someone and you haven't been able to prevent that risk. "Likely" here means more probable than not. If it is notifiable, you must tell the affected people and the Commissioner as soon as practicable. If quick action means serious harm is no longer likely, you don't have to notify.

Even if the scheme doesn't apply, ACSC's guidance for businesses says that depending on the impact, you may have to notify your customers, and suggests consulting the OAIC if you're unsure. If people's details were taken, IDCARE is a national identity and cyber support service for individuals and organisations. This guide isn't legal advice; if real customer data was exposed, get advice specific to your situation.

Keep readingStore enquiry details securely

Clean it properly, then close the hole

There are two ways to clean a hacked site, and Google describes both: replace the affected files with the last good backup, or remove the injected content and links page by page. Restoring a backup is usually faster, but only if the backup was taken before the attacker got in. Restore one from after the break-in and you've put the hack straight back.

Cleaning up is only half the job. If you don't find how they got in, they'll walk back through the same door. Google lists the usual ways in: a directory left with open permissions, an outdated content management system such as an old WordPress, Joomla! or Drupal version, and a hacked third-party plugin. Ask your developer to name the cause in writing, update everything, remove plugins you don't use and confirm the admin users are only the people who should be there.

Clean the whole site, not just the pages someone noticed. Google says the sample URLs in its report are "not necessarily complete", and that "Fixing the issue on just some pages will not earn you a partial return to search results."

Keep readingSet up updates and backups you can restore

Get Google's warnings removed

Google's Security issues report in Search Console shows what it found and when it was first detected. Google says to rely on that report as the source of truth, because browser warnings depend on context and you may not be able to reproduce them yourself. If the site isn't verified in Search Console yet, set that up now so you can see the report and request a review.

Once every issue is fixed on every page, select Request Review and describe exactly what was wrong and what you did to fix it. Google says reviews can take from a few days to a few weeks, and asks you not to resubmit before you get a decision. Sending a request before the problem is actually fixed can slow the next one down.

How long the warning lasts also depends on how Google found the hack. Google says that if hacking was detected automatically, the content is included again once it's detected as clean during a regular recrawl. If a person at Google flagged it manually, the owner has to request reinclusion.

Keep readingSet up Search Console before you need it

A worked example: a hypothetical plumber's website

This is a made-up example to show the order of steps, not a real client.

A plumbing business in Ballarat has a WordPress site that a freelancer built three years ago and nobody has updated since. On Monday morning a customer rings to say the site sent them to an online casino when they tapped the Google result on their phone. On the owner's laptop, typed in directly, the site looks normal.

The owner calls the freelancer, who still has the hosting login. Using the owner's phone, they change the WordPress, hosting, registrar and email passwords and turn on multi-factor authentication. They find an admin account called "support2" that nobody created, note when it was created and remove it. The freelancer finds a malicious redirect added through an old plugin, restores the files from a backup taken before that date, updates WordPress and every plugin, and deletes three plugins nobody uses.

The enquiry form only emails submissions and doesn't store them on the site, so there were no customer records on the server to take. The business turns over well under $3 million, so the Notifiable Data Breaches scheme doesn't apply, but the owner keeps a written record of what happened anyway. In Search Console the Security issues report shows hacked content. Once the whole site is clean they request a review describing the plugin, the redirect and the fix, then wait for Google's decision without resubmitting.

Checklist

Work through these in order:

• Note what you saw, when, and which pages, with screenshots.
• From a clean device, change the website admin, hosting, registrar and email passwords, and turn on multi-factor authentication.
• Remove admin users you don't recognise, after noting their details.
• Take the site offline if it's sending visitors to malware or fake login pages.
• Call your developer and host, and the ACSC hotline on 1300 CYBER1 if you need help reporting.
• Work out whether enquiry or customer data was stored and could have been accessed, and whether the Notifiable Data Breaches scheme applies to you.
• Restore from a backup taken before the break-in, or remove the injected content across the whole site.
• Find and fix how they got in, update everything and remove unused plugins.
• Request a review in Search Console's Security issues report once every page is clean.
• Set up maintenance so updates and tested backups keep happening.