Your website got hacked. Here’s the first hour.

This month a Grand Strand manufacturer’s web address started sending visitors through a chain of other hijacked sites to an online slots page in another country. The website itself was fine. Someone had changed the domain’s settings in September, and every visitor since had been sent somewhere else. Reinstalling the website would have fixed nothing.

That’s the most common mistake we see after a break-in: fixing the wrong thing first. Here’s how to work out what happened before you touch anything.

Minute one: make sure it’s real

Open the site on your phone with Wi-Fi turned off, and on a computer you don’t normally use. Hacked sites often show the bad version only to some visitors: people on phones, people arriving from Google, or anyone who isn’t logged in. If you only check from your office desktop, you can miss it.

The opposite happens too. A site can look down from one network because a firewall blocked that connection, while everyone else sees it fine. Check from two places before you decide anything.

Work out which of three things happened

• The website was changed. Pages you didn’t write, spam links, a strange popup, a redirect that only happens on some pages, or a warning from Google that the site is dangerous. Usually an out-of-date plugin, theme or password let someone in.
• The domain was taken or changed. Every page goes somewhere else, or the site and your email stop working at the same time. Someone got into the account where your domain is registered, or the domain lapsed. Our free domain check shows when its record last changed.
• An email account was taken over. Customers say they got odd emails from you, you find sent messages you didn’t write, or a forwarding rule you never set up. This is the one that leads to fake invoices and wire fraud.

What to do in the first hour

1. Don’t delete anything yetThe changed files, the strange emails and the logs are how anyone works out how they got in. Take screenshots with the date showing, and save the web address of anything strange.
2. Change the important passwords from a clean deviceYour hosting account, the website’s admin login, the registrar where your domain lives, and the email account. Use a phone or computer you trust, not the one that might be infected, and turn on two-step sign-in for each one as you go.
3. Call your hostAsk whether they see the break-in, whether they have a clean backup from before it started, and whether other sites on the same server are affected. Write down who you spoke to and when.
4. Check the domain and the emailLog in to your registrar and look at the nameserver and DNS settings: anything you don’t recognize? Then check your email for forwarding rules and recently added sign-in devices. If either was touched, that’s now the priority.
5. Tell the people who need to knowIf customer information may have been exposed, talk to your attorney the same day. South Carolina has a data breach notification law, and whether it applies to you is a legal call, not a technical one.

What not to do

• Don’t restore last night’s backup and call it fixed. If the break-in started weeks ago, the backup has it too, and the way in is still open.
• Don’t just delete the bad files. Most break-ins leave a second way back in, often a hidden admin user or a file that looks like part of WordPress.
• Don’t pay anyone who emails you offering to remove the hack or threatening to publish your data. That’s a second scam riding on the first.
• Don’t email customers from an account you think was taken over. Call them, or send from an account you know is clean.

Getting back to normal

A proper cleanup finds how they got in and closes it, removes everything they added, updates every plugin and theme, moves to a supported version of PHP if the server is behind, and turns on two-step sign-in everywhere. If Google flagged the site, the last step is asking it to review the site in Search Console, which usually clears the warning within a few days.

If the site was old and patched together to begin with, this is often the moment a rebuild costs less than a careful cleanup. Either way, keep the evidence until you’re sure nobody needs it.