Website Hacked? A Step-by-Step Recovery Guide for Australian Businesses

Site hacked right now? Our emergency line is open 24/7 on 0426 833 422. If customers are seeing a red warning or being redirected, call before you start deleting anything.

If your website has been hacked, the safest order is: contain the damage, take a backup of the infected site, clean every file and the database, close the hole the attacker used, then ask Google to remove any warning. Skipping steps is the main reason sites get re-infected within days.

This guide walks through each step in plain English. Some parts you can do yourself. Others are better handed to someone who cleans sites every week. We’ll tell you which is which.

How do I know my website has been hacked?

Very few hacks announce themselves. Modern attackers want your site to keep working, because they’re using it quietly to send spam, redirect visitors or host scam pages. These are the signs we see most often:

• A red Google warning such as “Deceptive site ahead” or “This site may harm your computer”.
• Strange redirects, often only on mobile or only when visitors arrive from Google, so you never see them yourself.
• Spam in Google results for your site, such as pages in Japanese or ads for pills and handbags.
• New admin users in WordPress that nobody on your team created.
• A warning from your host about outgoing spam, high CPU use or a suspended account.
• Odd files in places they don’t belong, such as PHP files inside the uploads folder.

For a fuller list, see 12 warning signs your website has been hacked. If you ticked even one of these, treat it as real until you’ve proven otherwise.

Step 1: Contain the damage

Your first job is to stop things getting worse. Don’t start deleting files yet.

1. Take a full backup of the hacked site. Copy all files and export the database, infected as it is. It sounds odd, but it gives you a rollback point and evidence of what happened.
2. Change every password. That means hosting, control panel, FTP or SFTP, the database and every WordPress admin. Use your password manager to make each one long and unique.
3. Log everyone out. Changing the security keys in wp-config.php forces every logged-in session to end, including the attacker’s.
4. Put up a maintenance page if visitors are at risk. If the site is redirecting people or showing a warning, it’s better to be briefly offline than to keep sending customers to a scam.
5. Tell your host. They may already know, and some will help. If you’re with us, call 0426 833 422 and we’ll take it from here.

Step 2: Clean the files and database properly

This is where most do-it-yourself clean-ups go wrong. A scanner finds a few bad files, they get deleted, and the site looks fine for a week. Then it’s hacked again.

The reason is simple. Attackers leave more than one way back in. Sucuri’s research found backdoors on 49% of compromised sites, and malicious admin users in 55% of infected databases. If you miss either, the attacker simply walks back in.

A proper clean-up covers four areas:

• WordPress itself. Replace the core files (wp-admin and wp-includes) with a fresh download. Don’t try to edit infected copies.
• Plugins and themes. Delete every plugin and theme folder and reinstall clean copies from trusted sources. Remove anything you don’t use.
• The uploads folder. It should hold images and documents only. Any .php file in there is almost certainly malicious.
• The database. Check the users list for unknown admins, and look for injected scripts in posts, widgets and settings.

Also check for scheduled tasks (cron jobs) and server files such as .htaccess that you didn’t add. These are common hiding places for code that reinstalls the infection.

If you’d rather not do this yourself, our guide to what a proper malware removal includes explains what to expect from a professional clean-up.

Step 3: Close the way in

Cleaning without fixing the cause is like mopping the floor while the tap is still running. Work out how the attacker got in, then close it.

The most common cause is out-of-date software. Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, and 91% were in plugins. Only six were in WordPress core. Heavily targeted flaws were being attacked within a median of about five hours of becoming public.

After the clean-up:

• Update everything that’s left, and remove any plugin that’s no longer maintained.
• Turn on two-factor login for every admin account.
• Add a firewall that blocks attacks before they reach WordPress. Our article on how a WordPress firewall works explains the options.
• Make sure PHP is a currently supported version.

Step 4: Get Google’s warning removed

Once the site is genuinely clean, you can ask Google to review it. Do this in Google Search Console, under Security issues. Explain what you found, what you removed and what you changed to stop it happening again.

Don’t rush this step. If Google reviews the site and still finds malware, the warning stays and later reviews can take longer. Run a final scan from outside and inside the site first.

Other blocklists, such as Norton or McAfee, have their own review forms. Our guide to how website blocklists work lists where to check and how to request removal.

Step 5: Monitor for re-infection

For the next 30 days, keep a close eye on the site. Check the admin users list each week, watch for new files, and keep an eye on Search Console. Daily offsite backups matter here too. If something slips through, you’ll want a clean copy from before it came back.

This is exactly what our Maintain & Protect care plans do: a firewall, daily malware scans, uptime monitoring, regular updates and offsite backups kept for 30 days. Sites on a plan are covered by our guarantee: hack-free, or we fix it free. If your site is already compromised when you join, the setup includes the clean-up.

Should I fix it myself or get help?

You can handle containment yourself, and you should. Changing passwords and taking a backup takes minutes and makes everything after it safer.

The clean-up is different. If you’re comfortable with FTP, databases and file permissions, you can work through Step 2 carefully. If those words make you nervous, get help. A partial clean-up is often worse than none, because it gives a false sense of safety.

Get help straight away if customer payment or personal details may have been exposed. You may have legal duties to notify people. Our guide to what to do after a data breach explains the Notifiable Data Breaches rules for Australian businesses.

Frequently asked questions

How do I know if my website has been hacked?

Common signs include a Google warning page, visitors being redirected to other sites, spam pages appearing in Google results, unknown admin users and warnings from your host. Some hacks only show on mobile or to visitors arriving from Google.

Can I just restore an old backup?

Sometimes, if you have a clean backup from before the hack. But you still need to change passwords and fix how the attacker got in. Otherwise the restored site can be hacked again the same way.

Why does my site keep getting re-infected?

Usually because a backdoor or rogue admin user was missed, or the original weakness was never fixed. Sucuri found backdoors on 49% of compromised sites and malicious admins in 55% of infected databases.

How long does it take Google to remove a warning?

After you request a review in Search Console, it often takes a few days, and sometimes longer. Google only removes the warning if the site is fully clean, so check thoroughly first.

Do I have to tell my customers?

If personal information was likely accessed and the breach could cause serious harm, the Notifiable Data Breaches scheme may require you to notify affected people and the OAIC. It applies to businesses with turnover over $3 million and to some smaller ones, such as health providers.

Sources

1. 2023 Hacked Website and Malware Threat Report, Sucuri, published June 2024
2. State of WordPress Security in 2026, Patchstack, accessed 13 Nov 2026
3. Security issues report, Google Search Console Help, accessed 13 Nov 2026
4. Quick reference guide: responding to data breaches, OAIC, accessed 13 Nov 2026