The hacked website checklist

1. Confirm it's actually a hack

   Check Google for your site (site:yoursite.com) — spam pages you didn't create are the classic sign. Also check for warnings in Search Console and messages from your host.
2. Don't panic-delete

   Deleting files randomly breaks the site further and destroys evidence of how they got in. Leave everything as-is until diagnosed.
3. Protect your visitors now

   If you can, put the site in maintenance mode — every visitor who hits a hacked page is a customer you're losing and a reputation hit.
4. Change the critical passwords

   WordPress admin, hosting panel, and database passwords — from a clean device, not the one you normally use.
5. Get a professional diagnosis

   This is the step most owners skip — and why most 'cleanups' fail. A real diagnosis finds the backdoors, not just the symptoms.
6. Remove everything malicious

   Malware, obfuscated backdoors, spam pages, rogue admin accounts, malicious cron jobs — by hand, then verified with a full rescan.
7. Close the entry point

   Update everything, lock down logins, fix file permissions, add firewall rules. Skip this and the hack returns within weeks.
8. Clear the warnings

   File Google Safe Browsing review requests and blacklist delistings once the site is verifiably clean.
9. Take a clean backup

   The day the site is verified clean, take a full backup and store it off-site. This is your reset button.
10. Stay protected

    Updates, monitoring, and regular scans — yourself, or with a care plan. A hacked-once site is a targeted site.

Tip: click a step to mark it done — your progress is just visual, nothing is sent anywhere.