Website hacked or down: what to do in the first hours

You open your company's website and a casino page shows up. Or Google shows a red warning saying the site is dangerous. Or the site just won't load, and the phone starts ringing. The first instinct is to delete whatever looks strange and hope it doesn't come back. It almost always does.

Website hacks are more common than they seem, and the most expensive mistake happens in the first hours. In Sucuri's hacked website report, published in 2024 with data from 39,594 sites its team cleaned in 2023, 49.21% of the sites had at least one backdoor installed. A backdoor is a hidden file that lets the attacker come back whenever they want. Deleting only what shows up on screen doesn't remove that file. This guide lays out the right order.

Hour 1: stop the damage before investigating

The goal of the first hour isn't to fix things. It's to keep them from getting worse.

• Put the site in maintenance mode or take it offline. A simple “back soon” page protects visitors and keeps Google from indexing the attacker's content.
• Change every password. Site admin, hosting, database, FTP, domain email, and the domain registrar account. Use new passwords and turn on two-factor authentication wherever you can.
• Revoke access you don't recognize. Admin users created in the last few days, old access keys, former vendors who can still log in.
• Tell the people who need to know. Support, sales, and whoever manages email. If customers call, everyone gives the same answer.

If you can't access any of this because everything is in a former vendor's name, that's the first problem to solve. We've written about how to recover your code and access when the freelancer disappears, and the same logic applies here.

Hour 2: save evidence before cleaning

It sounds counterintuitive, but before you delete anything, make a copy of the current state. Files, database, and the server access logs.

That copy serves three purposes:

1. Finding out how the attacker got in.
2. Knowing whether they reached customer data.
3. Having a record in case you need to notify the ANPD or answer a customer.

Keep the copy off the compromised server. And don't mistake it for a backup: this copy is infected and must not be used to restore anything.

How the attacker got in

Cleaning without finding the way in is like changing the rug with the window open. The most common entry points on company websites are:

• Outdated software. According to Sucuri, 39.1% of hacked sites were running an outdated CMS at the time of infection.
• Abandoned plugins and themes. A plugin nobody has updated in years is a door attackers already know about.
• Weak or leaked password. Especially for the admin panel and hosting.
• Forgotten access. A former vendor, a test user, an API key that was never revoked.

The same report shows what attackers usually do once they're in. 20.3% of cleaned sites had SEO spam: fake pages for pharmaceuticals, casinos, or Japanese text created inside your domain to exploit its reputation on Google. That's why the site sometimes looks normal to you and strange to people arriving from search.

One detail from the report: 95.5% of the infected sites Sucuri cleaned were WordPress. The company itself warns that this reflects its customer base and doesn't prove one platform is less secure than another. What matters is maintenance, not the brand of software.

Clean the whole site, not just the visible page

Once you've found the way in, cleanup has four parts:

1. Close the gap. Update the software, remove abandoned plugins, fix the setting that left the door open.
2. Remove everything the attacker added. Modified files, backdoors, fake users, spam pages, and redirects.
3. Check the database. Spam and malicious scripts get stored there too, not just in the files.
4. Restore only what's proven clean. A backup helps if it predates the attack. If you don't know when the attack started, the backup may be infected too.

Google Search Console Help is clear on one point: fixing only some pages won't get the site back into search. The problem has to be gone from all of them.

Google's warning: how to remove it

If Google has flagged the site as dangerous, searchers see an alert before they get in, and many give up right there. To remove the warning:

• Open the Security issues report in Search Console. It shows the type of issue, when it was detected, and sample affected pages.
• Fix every listed issue, on every page.
• Click Request review and explain the problem, what you did, and the result.

According to Google, the review can take from a few days to a few weeks. Google also asks you not to resubmit before you get a response. The web.dev review guide adds that requesting a review while the problem is still live only extends the time your site stays flagged.

In other words, a sloppy cleanup doesn't just cost rework. It costs more weeks of a red warning in front of everyone looking for your company.

If personal data was hit, the LGPD clock is ticking

Contact forms, customer sign-ups, logged-in areas, orders. If the site stores personal data and the attacker may have reached it, there's a legal deadline.

According to the ANPD's security incidents page, Resolution CD/ANPD No. 15/2024 requires the controller to notify the ANPD and affected people within 3 business days when the incident may cause significant risk or harm. The copy you saved in hour 2 is what lets you say precisely what leaked and what didn't.

At this point, bring in your lawyer or the company's data protection officer. Whether to notify is a legal decision. The tech team's job is to give an accurate answer about what was accessed.

Clean up or rebuild the site

After the emergency comes the question nobody wants to ask: is this site worth keeping?

Cleaning and updating works when:

• The site is recent and its foundation is up to date.
• The flaw was isolated, like a leaked password.
• Someone is in charge of updates from now on.

Rebuilding makes more sense when:

• The software and plugins are years behind.
• Nobody knows who built the site or how.
• This is the second or third attack.

If the site was already showing its age in other ways, read the signs it's time to rebuild your company website before paying for a cleanup you'll end up repeating.

How to avoid this next time

Most attacks start with something someone didn't do. The bare minimum:

• Updates applied regularly, not just when something breaks.
• Automatic backups, stored off the server and tested.
• Accounts, domain, and hosting in the company's name, with two-factor authentication.
• Someone checking the site every day. That's the idea behind monitoring your system to catch errors before your customers do.

How we do it at the Studio

In a rescue, we start with access: code, files, and accounts are moved into the client's name. Then comes discovery, which separates what can be cleaned from what needs rebuilding. Only then do we set a fixed price and timeline, with the deadline written into the contract. The work is done by our in-house dev team.

And every system we deliver ships with an AI agent that runs daily, flags failures, suggests improvements, and checks that the data makes sense. That kind of daily attention is what gets an attack spotted in hours, not through a customer's phone call.

If your company's website was hacked or went down and you need to get everything back live safely, the Studio's project rescue starts with discovery.