Your Website Got Hacked. Here's What to Do First.

The instinct is to delete the strange files and move on. Don't. If you clean without finding the entry point, you'll be doing it again next week — the attacker still has the key.

In this order

• Take the site offline or put up a maintenance page
• Copy the server files and database as they are, before changing anything
• Download the access and error logs — these show the entry point
• Change every password: hosting, database, admin, email, FTP
• Only then start cleaning

Restore from backup, don't patch

Attackers leave more than one way back in. Restoring a known-good backup from before the compromise and then applying updates is far safer than hunting for every file they touched. This is the moment your backup policy proves its worth or doesn't.

Tell people if their data was exposed

If customer details were in the database, say so plainly and tell people what to do. Quiet cleanups damage trust far more when they come out later, and they usually do.

Then close the door

Update the framework and every plugin, remove what you don't use, turn on two-factor authentication for admin accounts, and set up automated backups you have actually tested restoring from.