What to do if your website is hacked

Discovering that your website has been hacked can be stressful, but the good news is that Web60 takes automatic backups of your site every day. In most cases, we can have your site cleaned up and back to normal quickly. This guide explains the signs to look for and exactly what to do.

Signs your site may have been hacked

You might notice one or more of the following:

• Unexpected redirects — visitors are being sent to a different website when they try to visit yours
• Strange content appearing — text, images, or links on your site that you did not add
• Google warning — a red warning screen appears when people try to visit your site, saying it may be unsafe
• Slow performance — your site is suddenly much slower than usual for no obvious reason
• Unknown user accounts — new admin or user accounts in your WordPress dashboard that you did not create
• Spam emails — emails being sent from your domain that you did not write

If you notice any of these, it is worth investigating further.

What to do right away

1. Do not panic

This happens to websites of all sizes, and it is almost always fixable. Web60 takes automatic backups, so your content is safe.

2. Change your Web60 dashboard password

Go to your Web60 dashboard and change your password immediately. This stops anyone who may have gained access to your account from making further changes. If you cannot log in, contact support.

3. Contact Web60 support

Get in touch with our support team straight away. We can help investigate what happened, check for malware, and guide you through the recovery process. Visit our support page to get in touch.

4. Restore from a clean backup

Open the Backups tab in your Web60 dashboard and look for a backup from before the hack happened. Restoring from a clean backup replaces all your site files and database with the version from that date, removing the hack completely.

If you are not sure which backup to choose, our support team can help you identify the right one.

5. After restoring, secure your site

Once your site is restored from a clean backup, take these steps to prevent it happening again:

• Change all your passwords — update both your Web60 dashboard password and your WordPress admin password
• Update all plugins and themes — out-of-date plugins are the most common way hackers get in
• Remove any plugins you do not recognise — if you see plugins in your WordPress dashboard that you did not install, delete them
• Remove unused plugins and themes — even if they are turned off, they can still be a security risk

6. Enable two-factor authentication

For extra protection, install a free plugin like WP 2FA from the WordPress plugin directory. This adds a second step to your login, requiring a code from your phone as well as your password.

How to prevent future hacks

The best defence is prevention. Here are the most important things you can do:

• Keep plugins updated — set them to update automatically if possible, or check for updates regularly
• Use strong, unique passwords — avoid short or commonly used passwords, and do not reuse passwords from other sites
• Only install plugins from the official WordPress directory — avoid downloading plugins from unknown websites
• Remove plugins and themes you are not using — fewer plugins means fewer potential entry points
• Use two-factor authentication — adds a strong extra layer of security to your login

Web60 also provides multiple layers of security on every site, including firewall protection, malware scanning, and login protection, all included at no extra cost.

Need help?

If you think your website has been hacked, visit our support page and we will help you get it sorted.