My website was hacked: what to do right now (and next)

A client writes: "Your website sends me to a betting site." Or Google shows Japanese pages under your name. Your site has probably been hacked. Don’t panic: here is the exact order of actions.

In the first hour

1. Change every password: hosting, site admin (WordPress or other), database, FTP, email, domain registrar account. Use long, different passwords.
2. Turn on two-factor authentication wherever possible.
3. Put the site in maintenance mode if visitors are being redirected to dangerous sites.
4. Copy the current state (files and database): it helps understand the attack.
5. Alert your host: they often have logs and can isolate the account.

Find the cause

The most frequent causes, in order:

• Outdated WordPress plugins or themes (by far the first cause).
• "Premium" themes or plugins downloaded for free from shady sites: they often contain a backdoor.
• Weak passwords or passwords shared among several people.
• Badly configured hosting or hosting shared with infected sites.
• A former provider whose access was never removed.

Clean the site

Two options:

• Restore a clean backup dated before the attack, then immediately update everything that was vulnerable. Without fixing the hole, the site will be hacked again within days.
• Clean the site in place: remove malicious files, unknown admin accounts and injected pages, and check the database. This is specialist work.

Repair the damage on Google

• Open Google Search Console and check "Security issues".
• Remove hacked pages and request their removal.
• Once the site is clean, request a review.
• Check your domain isn’t on a spam list if your emails are being blocked.

Personal data

If client data (forms, accounts, orders) may have been exposed, Cameroon’s Law No. 2024/017 on personal data protection, in force since June 2026, imposes security obligations. Get advice. See Law 2024/017 on personal data: what your website must do.

Prevent the next attack

• Monthly updates of the site, theme and plugins.
• Automatic backups stored off the server and tested.
• Named admin accounts, strong passwords, two-factor authentication.
• Uptime and integrity monitoring.
• For sites that rarely change, a static site, almost impossible to hack.

That is exactly what our maintenance service covers: Website maintenance: what it covers and what it costs. If your site is hacked right now, message us on WhatsApp: we prioritise the diagnosis.