My website has been hacked. What should I do now?

Contain the incident. If the site is serving malware, redirecting visitors, leaking data or taking fraudulent payments, consider putting it into a controlled maintenance state or isolating the affected application. Contact the hosting or technical team before deleting evidence blindly.

Not until you understand whether that backup is clean and how the attacker got in. Restoring a vulnerable plugin, stolen credential or hidden backdoor can recreate the compromise. Preserve relevant logs, identify the likely entry point and restore from a known-clean backup with vulnerabilities closed.

Rotate website admin, hosting/control-panel, SFTP/SSH, database and relevant email/API credentials. If accounts share passwords, change those too. Use MFA where supported and remove admin accounts you cannot explain.

Compare files with known-good versions, look for unexpected PHP/scripts, review recently modified files, scheduled tasks, admin users, database injections and server logs. A clean-looking homepage is not proof the compromise is gone.

Check Security Issues and Page indexing, remove injected content from the site, ensure hacked URLs return appropriate 404/410 or clean redirects, submit a clean sitemap and request a security review when Google provides that option. Do not block hacked URLs in robots.txt before Google can recrawl the corrected response.

If personal data has been breached, assess the risk to people. UK data-protection rules can require notifying the ICO without undue delay and, where feasible, within 72 hours when the breach is likely to risk people’s rights and freedoms. Record the assessment even when you decide notification is not required.

No. A WAF can reduce some malicious traffic and help block known exploit patterns, but it does not remove malware or fix stolen credentials. Clean and harden the website first, then use a WAF as one additional security layer.

Keep software supported and patched, remove unused components, use MFA and unique credentials, reduce admin access, maintain tested backups, monitor changes, use reputable hosting and consider a WAF. Train the people who manage the website to recognise phishing, fake support messages and account-takeover attempts.