Confirm the warning signs without making things worse
A changed homepage, unfamiliar administrator account, unexpected redirect, or warning from your hosting provider may indicate a compromise. So can spam pages appearing on your site or a sudden flood of password-reset messages. One odd result is not always proof: a broken plugin or configuration mistake can look similar. Treat the situation as a potential incident while you check.
Write down what you noticed, when you noticed it, and which pages or accounts are affected. Save screenshots and copies of any alerts. Avoid repeatedly clicking suspicious links or downloading unfamiliar files to investigate. If you have a web developer, hosting support team, or IT provider, contact them through a phone number or account portal you already trust rather than replying to a possibly fraudulent alert.
Limit harm while preserving evidence
Your first priority is to reduce visitors’ exposure, especially if the site is redirecting them, displaying harmful content, or collecting information through a form you no longer trust. Ask your host or technical support provider whether they can temporarily restrict access or place the site in maintenance mode. If the problem appears limited to one feature, such as a contact form, disabling that feature may be less disruptive. Choose the smallest reliable step that protects visitors.
Before deleting files or restoring a backup, ask your technical contact to preserve a copy of the affected site and any available logs. These records can help identify what changed and whether the problem might return. Note who took each action and when. If you must act quickly without technical help, record the visible symptoms and the changes you make. Do not assume that taking the public site offline also blocks an attacker’s access to its administration area or hosting account.
Secure the accounts connected to the site
A website often depends on more than one login: the content management system, hosting account, domain registrar, email accounts, and third-party services may all matter. From a device you believe is safe, change passwords for affected accounts and enable multifactor authentication where available. Prioritize accounts that can reset other passwords or change where your domain points. Remove unfamiliar users and revoke sessions or access tokens if the service offers those controls.
Coordinate these steps with whoever is investigating. Changing a password may stop one route of access, but it will not remove malicious code or fix a vulnerable plugin. Conversely, restoring clean files will not help for long if an attacker still controls an administrator or email account. If a colleague’s device or mailbox may be compromised, have it checked before using it to manage the site again.
Find the cause, then restore carefully
Ask your developer or host to compare the affected site with a known-good backup, review available logs, and check for unexpected accounts, files, extensions, and configuration changes. The goal is not just to make the homepage look normal. A hidden account or altered file could allow the problem to recur. Update the website software and extensions, remove anything unneeded, and address the likely entry point before reopening the site.
Restore from a backup only after checking that it predates the suspected compromise and that the same weakness will not immediately expose the restored version. A small organization might keep a short recovery checklist: who can reach the host, where backups are managed, who approves taking the site offline, and how staff will handle inquiries. During recovery, test key pages, forms, and sign-in flows without entering sensitive information into a page you have not yet verified.
Communicate clearly and learn from the incident
If visitors may have seen harmful content or submitted information through an affected form, decide who needs an update and what you can say with confidence. Keep the message factual: what was affected, what steps you have taken, and where people can get help. Avoid declaring that no information was exposed unless you have a sound basis for saying so. Depending on the information involved and where your organization operates, you may need specialist guidance on notification obligations.
Once the site is stable, review the sequence of events with the people who maintain it. Make sure each account has an owner, remove access no longer needed, and set a routine for updates, backups, and checking that backups can be restored. The aim is not a perfect system; it is a website your team can monitor, protect, and recover with less uncertainty next time.
