What to Do in the First Hour After Your Website Is Hacked

Your inbox is full of bounce-backs, your homepage is redirecting somewhere strange, or your host has just emailed to say your account’s been suspended. However you find out, the first hour matters more than any other. What you do right now determines whether this is a contained incident or a much bigger mess involving lost customer trust, search engine blacklisting, and weeks of cleanup.

Here’s exactly what to do, in order.

Stay calm — then move fast

Panicking leads to two common mistakes: deleting files that could have shown you how attackers got in, or leaving the site live “just in case it fixes itself.” Neither helps. Work through these steps methodically instead.

1. Take the site offline, but don’t delete anything

Switch on maintenance mode or temporarily suspend hosting if you can. This stops the attack spreading to visitors and buys you time. Resist the urge to start deleting suspicious files — they’re evidence of how the breach happened, which you’ll need to actually fix the hole rather than just patch the symptom.

2. Lock every door, not just the one that was opened

Change passwords for hosting, your content management system or Shopify admin, FTP/SFTP, domain registrar, and any connected email accounts. Assume the attacker had access to everything you did. Revoke API keys and third-party app permissions too — a compromised plugin or integration is one of the most common entry points.

3. Alert your host, developer, and team immediately

Your hosting provider may already have logs showing when and how the intrusion started. If you work with a development partner, this is the moment to call them rather than wait for office hours — the longer malicious code sits live, the more it spreads and the more it can be indexed by Google as spam. If you don’t currently have anyone on retainer for exactly this kind of situation, our support plans exist for precisely this scenario.

4. Work out what was actually touched

Before rebuilding, check whether customer data, payment details, or order records were accessed — not just whether the homepage was defaced. This changes what you’re legally required to disclose and to whom.

5. Tell customers before they find out elsewhere

A short, honest message beats silence every time. If you run an online store and card data may be involved, you likely have a legal obligation to notify affected customers and your payment provider quickly.

How do you know if your website has actually been hacked?

Common signs include unexpected redirects to unfamiliar pages, a Google Safe Browsing or “This site may be hacked” warning in search results, new admin users you didn’t create, a sudden spike in outbound email or server traffic, defaced content, or your hosting provider flagging malware. Any one of these is worth investigating immediately rather than waiting to see if it resolves itself.

What happens after the first hour

Once the site is secured and access is locked down, the real work starts: identifying the exact vulnerability, cleaning every infected file, restoring from a clean backup where possible, and submitting your site for review with Google so any search penalty is lifted quickly — something we help clients recover through our organic traffic growth work, since a hack with no SEO recovery plan can tank rankings for months.

If the breach has exposed deeper problems — outdated code, a platform you’ve outgrown, or a store built on a patchwork of plugins nobody fully understands — this is often the point businesses decide to rebuild properly. Whether that’s a fresh website design, a hardened online store build, a move to Shopify with proper security baked in, or a custom platform via our bespoke development work, it’s worth doing it with full code ownership this time, so you’re never locked out of your own fix again.

If you’re dealing with a live incident right now, don’t wait — get in touch and we’ll help you triage it today. For more guidance like this, browse our blog.

FAQs