Playbooks / Hacked website

My website was hacked

Defaced pages, strange redirects, spam links, a Google “this site may be hacked” warning, or unknown admin users.

Use this if visitors are sent elsewhere, pages you did not write appear, or your host has suspended the site for malware.

First hour: stop the damage

Put the site in maintenance mode or take it offline at the host. Visitors being infected is worse than downtime.
Take a full copy of the site and database as it is now, before you change anything. You need it to find how they got in.
Change every password the attacker could have seen: hosting panel, FTP/SFTP, database, CMS admins, and the e-mail on the hosting account. Do it from a clean device.
Revoke API keys and tokens stored on the server (payment, e-mail, cloud). Treat all of them as exposed.

List recently changed files: find . -type f -mtime -14 (adjust the days). New or changed PHP files in uploads, wp-content or cache folders are the usual backdoors.
Look in the web server access logs for the first suspicious request. Paste the logs into the Access log attack finder to see which address attacked and what it tried.
Check for new admin users, unknown plugins and scheduled tasks (cron, WP-Cron). Attackers add their own way back in.
Compare with a clean copy: reinstall the CMS core and plugins from the official source and diff against your files.

Best path: rebuild on a clean server from a backup taken before the first malicious request, then apply all updates before going live.
If you clean in place, replace every core, plugin and theme file with fresh copies and delete anything not in the official packages. Remove unused plugins and themes entirely.
Update the CMS, plugins, themes and PHP to current versions. The Dependency scanner and CVE lookup show whether the version you ran had a known exploit.
Ask Google to re-review the site in Search Console if it was flagged, and check your domain on the Safe Browsing site status page.

Turn on automatic updates, two-factor authentication for admins, and a web application firewall at your CDN or host.
Keep daily off-site backups and test a restore once.
Scan the site with the Website scanner and fix the weaknesses it lists.

If customer data may have been exposed, see the India pack for the CERT-In 6-hour and DPDP duties.

General guidance, not legal or forensic advice. For a serious incident, involve a professional incident-response firm.