Skip to content
    HackFirstAid.com

    Business website hacked or defaced: how to recover

    Your business site was defaced, redirected or taken over. Lock down your hosting and domain accounts, restore from a clean backup, and check how they got in so it doesn't happen again.

    This is a business incident. Time and paperwork matter: insurers, banks and police will ask for evidence. You can follow the free steps below, or talk to Travis now.

    Do right now

    · Within minutes

    1. Determine the layer. (a) Sign in to your registrar (GoDaddy, Namecheap, Hover, Cloudflare). (b) Check WHOIS — if registrant email or name servers changed, it's a domain-level hijack. (c) Check DNS records (A, AAAA, MX, NS). (d) If all those look right but content is wrong, it's a CMS / hosting compromise.

    2. Registrar compromise (worst case): call the registrar's account-recovery line. Provide proof of ownership (original payment method, ID matching WHOIS, transaction history). Ask for an account lock and transfer-lock on every domain.

    3. DNS-layer compromise: sign into the DNS host, lock the account (password + 2FA), restore correct records from your last known-good config, and rotate any DNS-management API tokens.

    4. CMS / hosting compromise (most common): put the site into maintenance mode or take it offline — a 'back soon' page beats a malware warning. Change admin password from a clean device.

    Do today

    · Within hours

    1. Audit CMS user accounts — disable unfamiliar admins (recent creation, weird emails). Restore from a clean pre-compromise backup if available; managed hosts (WP Engine, Kinsta, SiteGround) keep daily backups — ask their support.

    2. If you can't restore, scan and clean. Tools: Wordfence, Sucuri, MalCare for WordPress; ImunifyAV at the hosting level. Look in theme files, wp-content/uploads, .htaccess, and the wp_options table.

    3. Update everything: CMS core, themes, plugins. Most CMS compromises trace to one outdated plugin. Rotate every credential the CMS knew (SMTP, payment gateway API, DB, FTP/SSH).

    4. Submit a Google Safe Browsing review (search.google.com/search-console → Security Issues) so the malware warning clears within 24–48 hours after cleanup.

    5. Verify mail records with mxtoolbox.com — if the attacker had domain access, MX/SPF/DKIM may have been changed and your sender reputation may be on a blacklist.

      MXToolbox

    6. Communicate plainly to customers — what happened, what's been done, what data was confirmed accessed. Avoid 'security is our top priority' boilerplate.

    Do this week

    · Within days

    1. Set up monitoring: uptime (UptimeRobot, BetterUptime), defacement (Detectify, Visualping on key pages), DNS monitoring (DNSstuff). Check certificate transparency logs at crt.sh for unfamiliar certs.

    Ongoing protection

    · Build the habit

    1. Registrar Lock + Registry Lock for important domains. Sign your zone with DNSSEC. Separate credentials per layer (registrar, DNS, hosting, CMS, payment) with hardware keys for registrar and DNS.

    2. Don't pay site-ransom demands — same rules as ransomware: recover from backup, follow-up extortion is the norm for those who pay.

    Related situations

    Business Email Compromise (BEC)

    Paid a fake invoice or wire request? Call your bank to recall it, secure email and report the fraud now.

    Email or Social Media Hacked

    Locked out of email, Facebook or Instagram? Recover the account, lock out the hacker and stop scams sent in your name.

    Device Infected (Virus / Malware / Ransomware)

    Virus, malware or ransomware on your phone or computer? Isolate it, protect your accounts and recover your files.

    Is this happening at work?

    If a business account, company device or customer data is involved, the steps change. Get help built for organizations.

    Go to business help →
    · Printed October 7, 2026