10 Essential Steps to Fix Hacked Website

Key highlights

• Understand how a hacked website can affect your data, search visibility and site access, helping you assess the true impact of a compromise.  
• Learn what effective hacked website recovery involves beyond removing visible malware for a more complete and secure restoration.  
• Know how to verify that your website is clean, functional and ready to return online with greater confidence.  
• Explore what to review after recovery to build a stronger response plan for future security incidents.  
• Discover how hosting security, backups and monitoring support ongoing protection and make future recovery easier to manage.

A hacked website can turn into a bigger problem quickly. Malicious code can redirect visitors, expose sensitive data, damage search visibility or give attackers continued access even after the obvious issue is removed. The priority is to get the site back online while making sure the threat is actually gone. 

To fix a hacked website properly, you need to contain the breach, identify what changed, remove malicious files or code, restore clean data where needed and close the vulnerability that allowed the attack. This guide walks you through 10 practical steps to fix, restore and secure a hacked website.

Quick overview: What to do immediately if your website is hacked

If your website is hacked, focus first on containing the breach and protecting access. Do not rush into deleting files or restoring a backup before you understand what has been compromised. 

Immediate action	What to do
Limit further exposure	Put the site in maintenance mode or restrict public access if it is redirecting visitors, serving malware or exposing sensitive data.
Preserve the current site	Save a copy of your website files, database and available logs before making major changes. Even an infected copy can help you investigate what happened.
Secure your accounts	Change passwords for hosting, CMS admin, FTP/SFTP, SSH, database and related email accounts. Revoke unfamiliar sessions and enable two-factor authentication where available.
Contact your hosting provider	Ask whether they detected suspicious activity, malware or account-level issues and what recovery options are available.
Check for signs of compromise	Run a malware scan and review admin users, recently modified files, redirects, server logs and Google Search Console security warnings.
Begin cleanup carefully	Preserve a copy of the current website before making major changes. Then secure affected accounts before removing malicious code or restoring from a known-clean backup.

These actions help stabilize the situation. The next step is to work through the full hacked website repair process and verify that the attacker no longer has a way back in. 

How to fix a hacked website: 10 essential steps

Treat these steps as a recovery sequence. What you do first can affect what you are able to investigate, restore and secure later. Keep a record of suspicious files, accounts, URLs and changes as you work through the site. 

Step 1: Limit access to the hacked website

If your website is redirecting visitors, serving malware, displaying spam or exposing sensitive information, limit access while you investigate. 

• Restrict public access: Put the affected site in maintenance mode or use another access restriction available in your hosting environment. If only a specific area is affected and you can isolate it safely, you may not need to take the entire site offline. 
• Record visible signs: Note malicious URLs, unexpected redirects, browser warnings, unfamiliar administrator accounts, modified pages and when you first noticed the problem. 
• Preserve initial evidence: Note recently modified files and relevant activity in available access or error logs before making major changes. 
• Check Google warnings: If Google has flagged the site, review the examples in Google Search Console’s Security Issues report. These can help identify the type of compromise, but they may not represent every affected URL. 

Avoid repeatedly visiting pages known to serve malware just to investigate them. At this stage, focus on reducing further exposure while preserving information that may help during cleanup. 

Step 2: Save a copy before you start cleanup

Before deleting infected files, restoring a backup or making major changes, save the website in its current compromised state. This copy is for investigation and data recovery, not for restoring the site later. 

Preserve the following where available: 

• Website files and configuration: Save the files currently running the site, including hidden files and configuration files such as .htaccess or wp-config.php for WordPress. 
• Database: Export the current database, especially for stores, membership sites or frequently updated websites where newer orders, registrations, comments or content may not exist in an older backup. 
• Logs: Preserve relevant access, error and authentication logs. They can help you trace suspicious requests, login activity and when the compromise may have started. 
• Scheduled tasks: Record cron jobs or other scheduled processes so you can later identify anything that could recreate malicious files. 

Keep this snapshot separate from your clean backups and label it clearly with the date, time and “compromised” status. Do not overwrite an existing clean backup with it. 

Preserving the current state gives you evidence to compare against clean files and protects legitimate data that may need to be recovered later. 

Also read: How to Create a Manual Backup 

Step 3: Reset passwords and revoke unauthorized access

Once you have preserved the compromised site, secure every account that could let an attacker regain access. Use new, unique credentials and start with the highest-privilege accounts. 

Change passwords or credentials for: 

• Hosting and CMS accounts: Reset your hosting/control panel credentials and all administrator accounts.  
• FTP/SFTP, SSH and database access: Replace compromised credentials and revoke any access keys you cannot verify. If you change a database password, update it in your website configuration so the site can still connect.  
• Domain, DNS and connected services: Secure these accounts if they may have been affected, including deployment tools or repositories that can modify website files.  
• Recovery email: Secure email accounts used to reset hosting or administrator passwords. 

Then remove access that should no longer exist. 

• Remove unknown users and privileged accounts you do not recognize.  
• Revoke active sessions and suspicious SSH keys, API keys or application passwords.  
• Enable two-factor authentication for privileged accounts where available. 

For WordPress websites, rotating the security keys and salts in wp-config.php invalidates existing WordPress login sessions, which can help remove access held through a stolen session. 

Make these changes from a trusted device. If an administrator’s computer or browser may also be compromised, secure it before entering new credentials. 

Step 4: Find everything that was compromised

Before removing malware, determine how far the compromise has spread. A single infected file may be only one part of the attack. 

Start with a malware scan, then check: 

• Website files: Look for unfamiliar or recently modified files, altered CMS core files, plugins or themes, suspicious configuration changes and unauthorized redirects. Compare files with verified originals where possible. 
• Database: Check for unknown administrator accounts, injected scripts, spam links, modified settings and pages or posts you did not create. 
• Scheduled tasks: Review cron jobs or other scheduled processes for unfamiliar entries that could recreate malware. 
• Logs: Review server access logs for suspicious requests, unfamiliar IPs or unusual file activity. For WordPress sites, WordPress logs can help trace what happened. Also check authentication and error logs around the time the compromise began. 
• Related websites: If multiple sites share the same hosting account or credentials, inspect them too. An infected site elsewhere in the account can cause reinfection. 

Document everything suspicious you find. You will use this list during cleanup and later when identifying how the attacker gained access. 

Step 5: Remove malware and hidden backdoors

Website malware removal should address both the visible infection and any mechanism that could let the attacker restore it. 

• Remove malicious files and code: Delete files confirmed to be malicious and remove injected scripts, redirects, spam content or other unauthorized code. 
• Clean the database: Remove malicious scripts, links, content or settings you identified in database tables. 
• Remove persistence mechanisms: Delete malicious cron jobs, scheduled tasks, unauthorized accounts or backdoors that could recreate the infection. 
• Replace altered application files: Where possible, replace compromised WordPress core files, plugin or theme files with verified copies from their official source rather than manually repairing unfamiliar code. 
• Scan again after cleanup: Run another malware scan and check whether any of the files or behavior you removed returns. 

Do not delete unfamiliar code simply because it looks unusual. Legitimate applications may contain minified or encoded code, so confirm what a file belongs to before removing it. 

If malware reappears after cleanup, assume that a backdoor or another persistence mechanism is still active and investigate further before moving on. 

Step 6: Restore a clean backup if needed

If the website is heavily modified or you cannot clean the affected files confidently, restoring a known-clean backup may be safer than continuing with manual cleanup. 

Before restoring, check: 

• Backup date: Choose a backup created before the compromise began, not simply the most recent backup available. 
• Backup contents: Confirm it includes the website files and database required for a complete restore. 
• Recent data: Identify newer orders, registrations, comments or content that could be lost when restoring an older database. 
• Software versions: Check whether the backup contains outdated or vulnerable software that will still need to be updated. 

A backup can already contain malware if the attacker gained access before the compromise became obvious. Scan the restored website before treating it as clean. 

Also remember that restoring a backup only replaces affected data. It does not fix the vulnerability or compromised access that allowed the attacker in, so continue with the remaining recovery steps. 

Step 7: Update vulnerable software

Once the site is clean or restored, update the software that could leave it exposed to another attack. 

• Update the CMS: Install the latest supported version of WordPress or the CMS your website uses. 
• Update plugins, themes and extensions: Apply available security updates using trusted or official sources. 
• Replace unsupported software: If a plugin, theme or application is no longer maintained, replace it with a supported alternative. 
• Remove unused components: Delete plugins, themes or applications you no longer need rather than leaving them installed but inactive. 
• Check unfamiliar additions: Remove any plugin, theme or extension added during the compromise unless you can verify that it is legitimate. 

If a vulnerable component contributed to the hack, confirm that the vulnerability has been patched before relying on that component again. 

Updating the site fixes known software vulnerabilities, but it does not show how the attacker first got in. 

Step 8: Find and fix how the attacker got in 

Cleaning the website is not enough if the original access point is still open. Use the evidence from the earlier steps to trace the most likely entry point. 

• Check login activity: Review available hosting, CMS, FTP/SFTP and SSH logs around the time the compromise started. Look for unfamiliar IP addresses, unexpected administrator logins or access at unusual times. 
• Check vulnerable software: Note the plugin, theme, CMS or extension versions running when the attack occurred. Compare them with official security advisories or changelogs to see whether those versions had known vulnerabilities. 
• Trace file changes: Sort suspicious files by modification time and compare them with clean originals. The earliest unexpected changes can help narrow down when and where the compromise began. 
• Check exposed credentials and permissions: Review configuration files, repositories and connected services for exposed passwords, API keys or credentials. Also check whether files or directories had broader write permissions than necessary.
• Check administrator devices: If the logs suggest valid credentials were used, scan the administrator’s computer for malware. Update the operating system and browser and secure the device before using new credentials. 

Once you identify a likely entry point, close it by patching or removing vulnerable software, rotating exposed credentials, removing unauthorized access or correcting file permissions. 

If the cause is still unclear, ask your hosting provider or a security professional to review server-level logs and account activity that may not be visible from your CMS. 

Step 9: Verify that the website is clean

Before bringing the site back online, confirm that the compromise is actually gone. 

• Run another malware scan: Check that the threats identified earlier are no longer detected. 
• Repeat the key checks from Step 4: Confirm that malicious files, unauthorized users, injected content, redirects and suspicious scheduled tasks have not returned. 
• Check Google Search Console: Open Security Issues to see whether Google still reports hacked content, malware or other security problems. 
• Review affected URLs sitewide: Google may show only sample URLs, so check for the same issue across the rest of the website. 
• Request a Google review if needed: If Google applied a security warning, request a review only after the entire site is clean and the underlying vulnerability has been fixed. 

When submitting a review, briefly explain what was removed and how the security issue was resolved. 

If malware, redirects or other unwanted changes return, keep the site offline and resume the investigation. A backdoor or unresolved vulnerability may still be present. 

Step 10: Test the website and bring it back online 

Once the security checks pass, test the recovered site before restoring public access. 

• Check key pages and navigation: Look for broken content, redirects or errors. 
• Test critical functions: Verify forms, logins, password resets, search and downloads. 
• Test transactions if applicable: Confirm checkout, payments, accounts and order flows work correctly. 
• Check restored components: Make sure reinstalled plugins, restored data and replaced files work as expected. 
• Clear caches: Purge website, server or CDN caches so visitors do not receive stale compromised content. 

Once the site is clean and working normally, bring it back online and create a new clean backup as your verified recovery point. 

From here, focus on what the incident revealed about your website setup and recovery process.

What to do after fixing a hacked website?

Use these post-recovery checks to turn those findings into practical improvements. 

• Document a known-good state: Record expected administrator accounts, active plugins or extensions and important configurations so unexpected changes are easier to spot later. 
• Review search impact: Check Google Search Console for hacked URLs or unwanted pages that may still appear in search, then review analytics for unusual traffic drops or changes. This helps you identify any SEO impact left by the hack and track whether search visibility is recovering after cleanup. 
• Fix gaps in your recovery process: Identify anything that made recovery harder, such as unavailable logs, unclear backup history or limited account visibility. Address these gaps so you can investigate and recover faster if another incident occurs. 
• Keep an incident record: Document when the compromise was discovered, what was affected, the likely entry point and the fixes applied. This gives you a clear reference if similar activity appears again. 

These post-recovery checks help you understand what changed, what worked and where your response can improve. Now, the priority is to ensure the right protection and monitoring are in place, so new threats can be detected and addressed before they turn into another full recovery effort.

How Bluehost helps you protect and monitor your website?

If your website is hosted with Bluehost, our hosting plans include security and website backup features that help protect your site. 

• Bluehost Malware Protection continuously scans your website for malware and automatically removes detected threats, reducing reliance on manual checks. continuously scans your website for malware and automatically removes detected threats, reducing reliance on manual checks. 
• SSL certificates encrypt data exchanged between your website and visitors, helping protect information while it is transmitted. 
• Managed WordPress updates help keep your WordPress software current and reduce exposure to known vulnerabilities. 
• Bluehost website backups provide restore points if you need to recover files or data after an unexpected issue. 
• Web application firewall and DDoS protection on supported plans add another layer of defense against malicious requests and disruptive traffic. 
• Security dashboards and reports give you visibility into detected malware, remediation activity and your website’s security status. 

Together, these protections make it easier to detect threats, respond when something goes wrong and maintain a more resilient website after recovery. 

If you are reassessing your hosting setup after a security incident, explore Bluehost Hosting plans to compare the security, backup and website management features available.

Final thoughts

Recovering a hacked website is more than getting it back online. A successful recovery leaves you with a clean, functional site, a clearer understanding of what went wrong and a more reliable approach to preventing and responding to future security incidents. 

If your current hosting setup leaves too much of that work to manual checks, consider moving to a platform where security, backups and site management are built into the hosting experience. Explore Bluehost Web Hosting plans to find the right setup with built-in security and recovery features for your website.

FAQs