Website hacked? What to do in the first hour

The first hour

1. Copy the site files, database and server logs somewhere safe.
2. Take the site offline, or put it in maintenance mode.
3. Change passwords and keys for hosting, the database, email, admin accounts and connected services. Do it from a computer you trust.
4. Write down what you saw and when. You’ll need the times later.

Find out how they got in

Look for admin accounts you don’t recognise, recently changed files, new scheduled tasks and unfamiliar plugins. Attackers often leave more than one way back in, so one removed file doesn’t mean the site is clean.

WordPress sites need extra care. After the UpdraftPlus incident in October 2026, TeamUpdraft warned that malicious plugins can delete their traces when they’re removed through wp-admin, and that accounts can be hidden from the admin view. Remove files over SFTP or your host’s file manager, and check users directly in the database.

Restore, then close the hole

Use a backup from before the attack, update everything, and install the fix for the hole you found. Rank Math’s advice after its own incident in October is a good rule: restore first, run a security scan, change all credentials, and install the updated software last.

Tell the people who need to know

If personal data may have been reached, the GDPR gives you 72 hours from when you became aware to report it to your data protection authority. In Sweden that’s IMY. Customers may also need to be told.