Website hacked: What to do in the first 24 hours?

Do not panic

Website hacking happens to hundreds of companies every week. With the right actions, damage can be minimised.

The first 60 minutes

1. Create a full backup of the website (even in its hacked state) – as evidence
2. Change passwords: WordPress admin, FTP, database, email
3. Activate maintenance mode – so visitors do not see the hacked content
4. Remove suspicious plugins and themes
5. Check if customer data has leaked (GDPR notification obligation!)

The first 24 hours

Diagnosis - What type of attack? (defacement, malware, redirect, SEO spam) - When did it start? (check the logs) - How did they get in? (plugin, password, FTP)

Cleaning - Use a scanner: Wordfence, Sucuri - Compare files with a clean copy of WordPress - Clean the database of suspicious content - Audit all admin accounts

Restoration - Prefer restoring a clean backup (from before the hack) - Update everything – WordPress, themes, plugins - Change all passwords again - Activate 2FA

The first 7 days

• Google Search Console: Check if the site is blacklisted
• Re-indexing: Request re-indexing from Google
• Customers: Notify them if data was leaked (GDPR – 72h!)
• Data Protection Inspectorate: Notify them if personal data leaked
• Police: Consider reporting to the cybercrime department

Costs

• DIY cleaning: €0 (but risky)
• Professional cleaning: €300–1,500
• Full restoration and hardening: €800–3,000
• Reputation recovery: Invaluable

How to prevent recurrence

1. Daily backups (off-site)
2. WAF (Web Application Firewall)
3. 2FA for all admins
4. Automatic security updates
5. Log monitoring
6. Professional maintenance

Summary

A hack is a crisis situation, but it is not the end of the world. A fast, professional response saves both money and reputation. If you need help – our emergency response team reacts within 2 hours.