What Happens in the First Hour After Your Website Gets Hacked

It usually starts the same way: a customer mentions the site looks odd, or Google Search Console sends a security warning, or the site itself starts redirecting to something bizarre. Here's what a realistic response actually looks like, versus the panic that tends to happen instead.

The first move should be isolation, not investigation. Put the site into maintenance mode or take it offline temporarily if possible, so the compromised version stops being served to visitors and stops potentially spreading malware further. Investigating exactly what happened can come second — stopping active damage comes first.

Change every credential that touches the site, not just the WordPress admin password — hosting account, FTP/database credentials, any connected third-party service. If one credential was compromised, assume the attacker may have found others stored nearby.

Restore from a backup taken before the compromise, not the most recent one — because the most recent backup might already include the malicious code. This is exactly why knowing when a backup was actually taken (and having more than one recent snapshot) matters so much.

Scan for injected code before declaring it fixed. A common mistake is restoring the visible site, feeling relieved, and missing a backdoor script quietly left behind that lets the attacker back in within days. A proper cleanup includes scanning the file system, not just checking whether the homepage looks normal again.

Only after the site is stable, investigate the actual entry point — was it an outdated plugin, a weak password, a compromised third-party integration — so the same hole doesn't get exploited again immediately.

The honest insurance policy here isn't an antivirus plugin — those help, but they're not a substitute for real, regularly-tested backups stored separately from the live server. Businesses that recover from a hack in hours rather than days are almost always the ones that had a genuine backup ready to restore from, not the ones scrambling to rebuild from scratch.