How to confirm and isolate a hacked website
Confirm the hack before you delete anything. A Safe Browsing warning, a redirect you did not add, an admin user you do not recognise, or PHP files in the uploads folder are enough. Then take the public site offline so visitors, and other accounts on the same server, stop loading the malware.
- Google shows a hacked-site or deceptive-site warning.
- Search or mobile visitors land on another domain.
- A new administrator is in the user list.
- The host suspends the account.
- Ads or odd links appear in the page source but not in your editor.
Unhacking a site is this same job. Do not start by deleting random files. Note what you see, including whether the fault is on one URL or every URL. On cPanel, a maintenance page or a disabled account is enough to stop public traffic while you work.
How to back up a hacked website before cleanup
Save a full copy of the infected site before you change a file. That copy is evidence, and a rollback if a delete breaks a shop. It is not a clean restore point.
Use the host backup tool, or download the site files and a database dump, and store them off the server. Record the date you last saw the site looking normal. A later comparison of file dates shows what changed after that day.
When to restore a backup instead of cleaning files
Restore a backup when you have a copy from before the hack and you have scanned that copy. Clean the live files when the only clean backup is so old that you would lose orders, posts, or payments you still need.
| Situation | What to do |
|---|---|
| Scanned backup from before the hack, and little new content | Restore that backup, then change every password |
| Backup is old, or new orders exist only on the live site | Clean the files and the database in place |
| Every backup still redirects or contains scripts in uploads | Do not restore it. Clean the live copy |
Scan the archive before you trust it. Malware is often older than the day you noticed it. If the restored site still redirects in a private window, the archive was already infected and you go back to a file-by-file clean.
How to scan and remove malware from a hacked website
Delete malware only after the infected backup is stored off the server. A scanner catches known signatures. It misses backdoors in the database and in files you edited, so check the places below even when the scan looks quiet.
- Run the host malware scan, or a security plugin if the admin panel still opens. Write down every path it flags.
- In WordPress, open wp-content/uploads and delete PHP and other scripts. That folder should hold media.
- Read .htaccess, index.php, wp-config.php, and the active theme header, footer, and functions files. Remove redirects and long encoded strings you did not put there.
- In the database, remove admin users you did not create, and remove injected links from posts and the options table.
- Replace wp-admin and wp-includes with a fresh copy of the same WordPress version. Keep your own wp-config.php. Reinstall plugins and themes from the vendor, not from a free copy of a paid zip.
- On a site that is not WordPress, replace the application core from the vendor and treat recently changed files outside the content folders as suspect.
Test in a private window after each major delete. If the homepage breaks, you know which change did it. Unknown files with recent dates, sitting next to core files, are the usual backdoor.
How to patch files and passwords after a website hack
Change every secret after the files are clean. A new admin password does nothing if FTP still accepts the old one and the attacker uploads the malware again.
- Hosting panel password.
- FTP and SFTP accounts.
- Database user, then the password inside the config file.
- Every CMS administrator.
- Email accounts that can reset the passwords above.
Update core, plugins, themes, and the PHP version the host still supports. On a shop, update one plugin at a time. A white screen is usually a single plugin: rename its folder in the file manager to turn it off. Delete inactive plugins and themes. Replace the WordPress authentication salts so old login cookies stop working.
How to request blacklist removal for a cleaned website
Ask Google to review the site only after a private window shows your real pages, with no redirect. A review of a site that is still infected does not clear the warning.
- In Google Search Console, open the security issue and request a review. Say which files you removed and which passwords you changed.
- Clear the site cache and any CDN cache before you decide the public URL is clean.
- Leave the site online and clean while you wait. The review is not instant. If the warning returns, a file you missed is still being served.
Other browsers and security tools keep their own lists. Fix Google first. The same clean homepage is what those other checks need to see.
How to prevent hacking of a website after cleanup
Stop the next hack by closing the hole that let this one in. Cleaning files, then leaving the outdated plugin and the old FTP password, is why the site is hacked again.
- Update core, plugins, and themes, and delete anything abandoned.
- Use a unique password and two-factor authentication on the admin, the email, and the host.
- Do not install nulled themes or free copies of paid plugins.
- Keep off-site backups, and restore one as a test so you know the archive opens.
- Run a vulnerability check after cleanup so the next outdated plugin is visible before it is used.
WebJi® website security services include a security audit and malware-cleanup consultancy at ₹4,200 a year before 18% GST, read on 30 October 2026. Anything outside that line is quoted before you pay: Contact WebJi® and the desk sends the figure first. A WordPress site can add WordPress security hardening once the files are clean.
Frequently Asked Questions
How do I know if my website has been hacked?
Treat it as hacked if Google shows a Safe Browsing warning, search visitors are redirected, a new admin user appears, the host suspends the account, or PHP files sit in the uploads folder. Check in a private window, because a logged-in editor can see the clean page while everyone else is redirected.
What should I do first if my website gets hacked?
Take the public site offline or put it in maintenance, then save a full copy of the infected files and the database somewhere that is not on that server. Do not delete files first, and do not pay a ransom note before that copy exists.
Can a hacked website be recovered?
Yes. Restore a backup you have scanned and found clean, or replace the application core and delete injected code while you keep posts and orders. Recovery fails when every backup is infected, or the database was dropped and you have no dump.
How do I clean a hacked WordPress website myself?
Back up the infected site, delete unknown administrators, remove PHP files from uploads, replace wp-admin and wp-includes from a fresh WordPress package, and reinstall plugins and themes from the vendor. Then change the cPanel, FTP, database, and admin passwords. If wp-admin will not load, do the file work in the host file manager.
How do I get my site off Google's blacklist?
Clean the malware first and confirm the real homepage in a private window. In Google Search Console, open the security issue and request a review. A review request sent while a redirect is still live does not clear the warning.
Why do hacked sites get reinfected so often?
A backdoor file or an old password is still valid, or the outdated plugin that let the attacker in was never updated. Inactive plugins and pirated themes are common leftovers. Rotate every secret and delete software you do not use.
How much does professional malware cleanup cost in India?
WebJi® lists Website Security Consultancy at ₹4,200 a year before 18% GST. That price was read on 30 October 2026 from the live billing file and covers a security audit plus malware-cleanup consultancy. Cleanup outside that line is quoted by email at support@webji.services before you pay.