Website hacked: clean it up or rebuild?

Key takeaways

If your website is hacked, contain it first: change all passwords, take the site offline or into maintenance mode if needed, and preserve a copy for investigation. Clean it if the platform is supported and the entry point can be found and closed. Rebuild if the platform is unsupported, the hack keeps returning or nobody can find how it got in.

• Contain first: change every password and revoke unknown users.
• Clean up if the platform is supported and the entry point is found.
• Rebuild if the hack recurs or the platform is unsupported.
• Report to the ICO within 72 hours if personal data is at risk.

What should you do first if your website is hacked?

Contain the damage. Change passwords for hosting, CMS, database, FTP and email, remove unknown admin users, and put the site into maintenance mode if it is serving malware or spam. Keep a copy of the compromised site for investigation. Then work out how the attacker got in before restoring anything.

• Signs your business needs a new website
• Website security for small businesses

How do you know the site has been hacked?

Signs include browser or Google warnings, spam pages appearing in search results, unexpected redirects on mobile, unknown admin accounts, and emails from the site that you did not send. Google's web.dev guidance on hacked sites and the Security Issues report in Search Console help confirm it.

• Google Search Console for small businesses

When is cleaning up enough?

When the platform, theme and plugins are supported, the entry point is found and closed, and a clean backup from before the hack exists. Restore or clean the files, update everything, harden access with strong passwords and two-factor authentication, and monitor closely for several weeks.

When should you rebuild instead?

Rebuild when you cannot trust the old code.

• The platform, theme or key plugins are unsupported.
• The hack returns after cleaning.
• Nobody can identify the entry point.
• There is no clean backup from before the compromise.
• The site has been modified so heavily that nobody knows what is original.

• Unsupported CMS: what to do when support ends
• Website technical debt: when to stop patching

Do you have to report a website hack?

If personal data may have been accessed, such as enquiry form submissions or customer accounts, UK GDPR requires you to report the breach to the ICO within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people. You may also need to tell affected individuals. The ICO's small organisation guidance explains the steps.

• What a UK website privacy policy must include

How do you stop it happening again?

Keep software updated, use strong unique passwords with two-factor authentication, limit admin accounts, take regular off-site backups and test restores. The NCSC's Cyber Essentials scheme covers these basics and is a useful standard for a small business.

What should you tell customers?

Tell them promptly and plainly if their data may have been affected, what happened, what you are doing and what they should do, such as watching for suspicious emails. If only the website's content was affected, a short notice is usually enough while the site is restored.

Keep a record of the incident, the decisions made and the dates, which the ICO expects for any personal data breach, reported or not. A calm, factual message protects trust far better than silence, especially if customers see browser warnings or spam before you tell them.

• Say what happened in plain words.
• Say what data, if any, may be affected.
• Say what you are doing and what they should do.
• Record the incident and decisions with dates.

What does this look like in practice?

A pattern in UK SMEs: a site on an abandoned theme is cleaned twice by different contractors and hacked again each time, because the vulnerable theme stays in place. Rebuilding on a supported theme, with the same URLs and content, ends the cycle. The cost of the two clean-ups would have covered much of the rebuild.

• See client work
• Website Design & Development for UK businesses

Hacked website checklist

Follow these steps in order.

• Change every password and remove unknown users.
• Put the site into maintenance mode if it serves malware.
• Keep a copy of the compromised site.
• Assess whether personal data was exposed; report within 72 hours if so.
• Find and close the entry point.
• Clean or rebuild, then harden and monitor.

Next step

If your site has been hacked, we will assess it with you and tell you honestly whether a clean-up will hold or a rebuild is safer.