Website Hacked? What to Do First

September has been a loud month for website security in the Philippines. The DICT and the Cybercrime Investigation and Coordinating Center issued a joint advisory dated September 8, 2026, placing government agencies and critical infrastructure operators on heightened cyber vigilance after a confirmed intrusion at the Department of Migrant Workers and the defacement of a Department of Labor and Employment web host.

Small businesses are not covered by that directive, but the situation it describes is familiar: you open your website and something is clearly off. Pages you never wrote. A browser warning. An administrator account nobody created.

A compromised website is recoverable, and the order you work in matters more than technical skill. Here is a calm first response — confirm, lock down, choose a recovery route, clean properly, then clear search warnings.

Confirming a Real Compromise

Not every broken website has been attacked. A blank screen after a plugin update, an expired certificate, or a PHP version change can all look alarming. Before pulling anything apart, identify what WordPress calls indicators of compromise — the symptoms that made you suspect a hack.

• Your site is flagged or blocked by Google, Bing, or a visitor's antivirus
• Your hosting provider has suspended or disabled the site
• Pages you did not write appear, often in an unexpected language
• New administrator accounts, plugins, or scheduled tasks you did not create
• Customers report that your Messenger link sends them somewhere unfamiliar
• The homepage visibly displays content that is not yours

Write down what you saw and when, in Philippine time, together with anything that changed recently — a plugin installed, a theme file edited, a widget added. The official WordPress guidance on hacked sites describes this as your incident report baseline, and it stays useful whether you clean up yourself or hand it to someone else.

What to Do in the First Hour

The goal in the first hour is not to fix the website. It is to stop things getting worse and preserve what you will need later.

If customer data or a payment flow may be affected, pause that specific public-facing flow now and ask your hosting provider, together with whoever owns that system on your side, to help assess the impact — before moving on to the rest of this checklist.

Lock Down Every Access Point

Changing passwords is the step everyone knows and the step most often done too narrowly. A compromise rarely stops at the WordPress login. Change credentials at every access point: WordPress administrators, FTP or SFTP, your hosting control panel, and your database user — for everyone with access, not only yourself. A home-based seller in Quezon City sharing admin access with a part-time designer should treat both accounts the same way.

New passwords do not sign out someone already logged in. WordPress keeps sessions alive through the secret keys in wp-config.php, so generate a fresh set from the official WordPress key generator and replace the existing values. Everyone is signed out at once, including anyone who should not be there. Locked out entirely? Reset by email, or use your control panel's database tools to update your user record.

Save a Snapshot Before Cleaning

Take a copy of the site exactly as it is now, infection included. It feels counterintuitive, but if cleaning goes wrong you will want that reference copy, and understanding the entry point depends on it.

Then tell your hosting provider. On shared hosting the issue may be wider than your account, and your host can often say quickly whether this is an attack or a service problem — the Z.com Help Center is the place to start. This also protects your email: sites abused for spam get their server address blacklisted, quietly breaking the order confirmations and invoices you send customers.

Choosing Your Recovery Route

Three realistic routes lead back, and the right one depends on your backups and available time.

Restoring is usually quickest, with two conditions: restore from a point before the compromise, then close the hole that let the attacker in. A backup restored onto the same unpatched plugin simply gets reinfected. Notably, when the DICT and CICC listed priority measures, checking whether backups can actually be restored sat alongside fixing critical vulnerabilities and enforcing multi-factor authentication. An untested backup is an assumption, not a safety net.

Z.com WordPress Hosting includes daily automated backups with restore from the WP Squared dashboard, plus a staging site on every plan — so you can rebuild a clean copy and check it before pointing customers back at it.

Cleaning Without Getting Reinfected

Most reinfections happen because the cleanup was partial: visible files scrubbed, backdoor left behind. Work through four areas, not one.

• Core files. Reinstall the same WordPress version you were running, uploaded over FTP rather than through the dashboard updater. WordPress documentation notes /wp-admin and /wp-includes can be replaced wholesale this way, because the updater overwrites known files and leaves whatever the attacker added.
• Themes and plugins. Replace these from clean copies rather than repairing them, and delete anything you are not actively using.
• Configuration files. The .htaccess file is among the most commonly modified, and copies can sit in several directories, not only the site root. Check all of them, along with index.php, header.php, footer.php, and functions.php, since changes there affect every page request.
• Users and the database. Remove administrator accounts you did not create. Injected spam links often live in the database rather than in files, which is why a files-only cleanup leads back to the same problem later.

Clearing Search Warnings and Reopening

If Google flagged your site, cleaning it does not lift the warning by itself. Open the Security Issues report in Search Console, confirm the problem is resolved, then select Request Review.

Two details matter. Fix the issue across your whole site, not only the sample URLs Google lists, because a partial fix will not earn a partial return to search results. And make the request useful: explain the issue, describe what you did, document the outcome. Reviews take a few days to a few weeks, with progress reported by email, and submitting before the problem is fixed can lengthen the next turnaround.

While you wait, be straightforward with customers. Post the update on the same official Facebook Page and Messenger account they already follow, rather than a new page or number, so there is nothing unfamiliar for them to verify. If any payment details ever need to change during this period, do not rely on that same account alone to confirm them — that account could be the compromised one. Ask customers to verify a changed payment destination through a separate contact method they already knew before the incident, such as a phone number or email you have used with them previously, and to hold off paying until it checks out. Handling the gap openly, through channels customers already recognize, reads as competence rather than crisis.

Frequently Asked Questions