Website hacked – what should you do?

Website hacked? How to recognize and verify it

Not every attack is immediately visible. Typical signs are foreign content or spam pages on your website, unexpected redirects, warnings in the browser or in Google search results, unknown administrator accounts in the CMS or a server that suddenly becomes noticeably slow. Customers who noticed something strange often get in touch as well, or your host suspends the package because of unusual activity.

Google Search Console gives a first indication: in its Security issues report, Google reports detected malware or hacked content. A search for “site:yourdomain.com” can also reveal foreign pages with spam terms. That is no substitute for a reliable diagnosis – the thorough examination of files, database and user accounts should be done by specialists. Unusual entries in your host's access statistics can also be a clue.

• Foreign content, links or spam pages
• Redirects to unknown websites
• Warnings in the browser or on Google
• Unknown user accounts in the CMS
• Host reports anomalies or suspends the package
• Emails from your domain suddenly land in spam

The first steps: stay calm and inform your host

The most important first step sounds banal: stay calm and do not delete anything in haste. Anyone who removes files in a panic or restores an old backup without checking destroys traces that matter for finding the cause – and the vulnerability stays open. Instead, note what you noticed, since when, and which messages or hints you received.

Then inform your host. They can preserve logs, temporarily block the website or put it into maintenance mode, and they know whether other packages are affected. If a service provider is responsible for your website, involve them immediately. Take the website offline if visitors could be at risk, for example through malicious code or manipulated forms.

Having credentials changed – but from a safe device

After an attack, all credentials must be considered compromised: hosting customer account, FTP or SFTP access, database, CMS administrators and the domain's email mailboxes. Change these credentials or have your service provider change them – and from a device that is demonstrably clean. If your own computer is infected, the new passwords will end up with the attacker as well.

Use a separate, strong password for each access and enable two-factor authentication wherever possible. Check in the CMS which users exist, and remove unknown or no-longer-needed accounts. Former employees, previous agencies or freelancers with still-active access are also a risk that you should close now.

Repairing a hacked website: backup, cleanup, root-cause analysis

Before cleaning up, the current state should be backed up – files, database and logs. This backup serves analysis and, if necessary, as evidence, not restoration. Afterward, specialists determine whether a clean backup from before the attack exists, how the attackers got in and whether hidden access points were left behind.

Restoring a backup without knowing the cause often helps only for a short time: if the vulnerability is still open, the website can be infected again. Common causes are outdated plugins, themes or extensions, components that are no longer maintained, and weak or reused passwords. With our hacked website help, we take care of cleanup, root-cause analysis and hardening – so the attack remains a one-off.

Reporting a hacked website: data protection, police and Google

If personal data is affected – such as customer data, form entries or accounts in a store – a reporting duty under Art. 33 GDPR may apply. The report to the competent data protection supervisory authority must then be made if possible within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the data subjects. In case of high risk, the data subjects must also be informed.

Have this question reviewed promptly by your data protection officer or an attorney. Independently of that, you can file a report with the police; in Germany, the state criminal investigation offices (Landeskriminalämter) offer businesses their own cybercrime contact points. If Google has flagged your website as dangerous, request a review in Search Console after the cleanup is complete. These notes do not replace legal advice.

Website hacked – who is liable?

As the operator, you are fundamentally responsible for your website – including for ensuring that personal data is protected by suitable technical and organizational measures, as Art. 32 GDPR requires. If malware is spread or data is siphoned off via a hacked website, claims by third parties or measures by authorities can result. How great the risk is depends heavily on the circumstances.

Whether a service provider is also liable depends on the contract: anyone who took on maintenance and security updates, for instance, has to deliver them. Also check whether you have cyber insurance and which reporting deadlines it prescribes. Inform customers or partners if suspicious emails were sent in your name. Binding answers on liability can only be given by legal advice – this section does not replace it.

Visited a hacked website – and how quickly can an attack happen?

If, as a visitor, you opened a hacked website, close the page, download nothing and enter no data. Run an up-to-date virus scanner and keep your browser and operating system up to date. If you entered login credentials there, change them immediately. You can reach the operator via the contact details in the legal notice (Impressum).

For operators: automated programs continuously scan the internet for reachable websites and known vulnerabilities. A new, publicly reachable website can therefore receive its first access attempts shortly after launch – regardless of how well known the company is. Regular updates, secure credentials, separately stored backups and a vulnerability analysis are therefore not optional extras but basic equipment.