Limit further exposure
If visitors are being redirected, seeing malware or exposed information, consider maintenance mode or restricting access. Avoid unnecessary changes before useful evidence is kept.
Support contacts
coming soon
coming soon
Has Your Website Been Hacked?
If your website is redirecting visitors, showing a security warning, displaying pages you did not create, has been suspended by your host or you have lost access, treat it as a suspected compromise until it has been properly checked.
Quick answer
Limit further exposure, secure domain, DNS, website and hosting access from a trusted device, preserve useful files and logs, then investigate before deleting files or restoring a backup.
Website recovery specialist directory coming soon. This page provides immediate guidance; no recovery provider is listed here yet.
Warning signs of a hacked website
One symptom alone does not prove the cause. However, unexpected redirects, injected pages, unknown accounts, security warnings or a host malware alert need prompt investigation.
- My website redirects visitors somewhere else
- Google, my browser or my host says the site is dangerous
- Pages I did not create are appearing in Google
- I have been locked out of WordPress or the website dashboard
- My hosting company says malware was detected
- There is an administrator account I do not recognise
- The website has been suspended or taken offline
- Visitors are seeing pop-ups, spam or unexpected adverts
- Website traffic or search visibility suddenly collapsed
Respond calmly and preserve the information you need
Do not rush to delete files or restore a backup without understanding what changed. The safest response is to limit harm, protect access and keep the information needed to recover safely.
Secure domain, DNS and hosting access
From a trusted device, check the domain registrar, DNS host, nameservers and important DNS records before changing them. Then review website administrators, hosting, database, FTP/SFTP, SSH and related email accounts. End unfamiliar sessions and reset affected credentials.
Preserve useful information
Keep a copy of the current website, database and available logs before destructive cleanup. They can help establish the timeline and route of entry.
Contact the hosting provider
Ask what malware, unusual sign-ins, changed files, resource abuse, backups and logs they can see. Confirm what is available before records expire or are overwritten.
Investigate before cleaning
Check users, changed files, plugins, themes, extensions, databases, redirects, scheduled tasks and server logs. Visible malware may be only one part of the incident.
Recover and close the route in
Use a known-good backup only after checking when the compromise began. Remove malicious changes, patch vulnerable software, rotate credentials and verify the website before normal use.
Why DNS and domain control matter
Your website can be technically clean but still unsafe if somebody else controls the domain registrar or DNS. An attacker may change nameservers, point visitors to another server, alter email routing, create deceptive subdomains or interfere with renewal and recovery emails. Record the current DNS settings before making changes and secure the registrar account with a unique password and MFA where it is available.
Four things every website owner should know
These services are often run by different companies. Knowing who controls each one makes recovery much easier if something goes wrong.
Your domain registrar
This is the account where the web address is registered and renewed. It is the key to who ultimately controls the domain name.
Your DNS provider
DNS is the internet's address book. It tells visitors where the website lives and tells other systems where email should go.
Your website hosting
This is where the website files, database and server settings are kept. Hosting can be separate from the domain and DNS provider.
Your recovery access
Keep the account owner, recovery email and MFA method current. If these are controlled by a former employee or agency, recovery can become much harder.
Possible causes
How was my website hacked?
The cause cannot be confirmed without investigation. Common routes include an outdated plugin, theme or CMS; a stolen or reused administrator or hosting password; compromised developer access; unsafe third-party code; weak access controls; or a backdoor left behind after an earlier incident.
Recovery means more than cleanup
Close the original route of entry
Removing a visible malicious file is not enough on its own. A proper recovery checks files, databases, users and access, then repairs or restores the site, patches the weakness, rotates credentials and verifies that the issue does not return.
Can I just restore a backup?
A backup can be useful, but only when it is known to be clean and pre-dates the compromise. Restoring an infected backup can reintroduce malware, while restoring an old copy can lose recent orders or content. A backup does not automatically fix a vulnerable plugin, stolen password or compromised hosting account.
Before an incident: who owns backup and restore?
If another company, agency or freelancer manages your website, ask this question before anything goes wrong — and get the answer in writing: if the website needs restoring after a hack, failed update or mistake, who does the work and who picks up the bill?
- What is backed up: website files, database, email, DNS settings or all of these?
- How often are backups made, where are they held and how long are they retained?
- Who checks that a backup can actually be restored?
- Is emergency investigation and restoration included in the agreement, or chargeable separately?
- What approval, hourly rate or fixed cost applies before recovery work starts?
Official domain and DNS recovery routes
Use the official provider route only. Check the web address in your browser before sharing account or identity information.
Nominet.UK recovery support — identify your registrar and get helpICANN.com and international domain recovery guidance123 RegAccount and domain recovery formGoDaddyRegain access to a domain or accountCloudflareAccount recovery guidanceFasthostsOfficial support route
Website and SEO recovery are related but different
Malicious pages, unexpected redirects and security warnings can affect visitors and search visibility. Once the website is technically clean, check Search Console, indexed pages, sitemaps, security issues and unwanted URLs. Use the relevant review process only after the underlying issue is resolved. Avoid anyone who promises an immediate return to previous rankings.
Clear first steps while we build the right recovery network
Been Hacked Fix is developing a directory of independent website-recovery specialists. We are not currently accepting hacked-website recovery requests through this page and do not yet list a provider here.
Do not send passwords, recovery codes, private keys or full administrator credentials through a public form or email. Agree a secure access process directly with any provider you choose.
Website hacked: common questions
How do I know whether my website has been hacked?
Unexpected redirects, security warnings, unknown pages, unfamiliar administrators, host suspension and unexplained changes should be investigated. They can indicate compromise, but the cause needs checking.
Can I just restore a backup?
A backup can help only when it is known to be clean and pre-dates the compromise. Restoring an infected backup, vulnerable plugin or stolen credential can bring the same problem back.
Can a hacked website be recovered?
Many compromised websites can be recovered. The right approach depends on the platform, hosting access, available backups, extent of change and whether the original route of entry can be closed.
Why did my website disappear from Google?
Malicious pages, redirects, security warnings and spam can affect search visibility. Technical cleanup and search recovery are related but separate jobs, and neither should be promised before assessment.
Need a simple website while yours is being fixed?
A temporary holding site can keep customers informed while the original website is investigated and repaired. It is not a replacement for fixing the compromise, but it can reduce the time your business has no public presence.
- Log in to ChatGPT, or choose an eligible paid plan if Sites is not available on your account.
- Open Sites and describe a simple temporary page: your business name, contact route, opening hours and a short update for customers.
- Review it, publish it publicly and add the domain you already own in the Site settings.
- At your DNS provider, change only the website records required by the new Site. Keep a record of the old values.
Do not remove or overwrite MX, SPF, DKIM or DMARC records unless you understand the effect on email. Keep the temporary site simple and move the domain back only once the original site has been properly checked.