{"id":4521,"date":"2026-11-05T15:03:09","date_gmt":"2026-11-05T14:03:09","guid":{"rendered":"https:\/\/www.cint-consulting.com\/my-website-has-been-hacked-what-to-do-in-the-first-hour\/"},"modified":"2026-11-05T15:03:09","modified_gmt":"2026-11-05T14:03:09","slug":"my-website-has-been-hacked-what-to-do-in-the-first-hour","status":"publish","type":"post","link":"https:\/\/www.cint-consulting.com\/en\/my-website-has-been-hacked-what-to-do-in-the-first-hour\/","title":{"rendered":"My website has been hacked: what to do in the first hour"},"content":{"rendered":"<p>If you\u2019re reading this, your website is probably doing something strange: it redirects to other pages, Google warns that it\u2019s dangerous, posts appear that you didn\u2019t write, or it simply won\u2019t load. First things first: stay calm. What you do in the first hour determines whether the issue remains a scare or if attackers return within a week.<\/p>\n<p><strong>Would you prefer us to take a look?<\/strong> <a href=\"https:\/\/www.cint-consulting.com\/en\/website-hacked\/\">We provide a free diagnosis today<\/a>, or call us at <a href=\"tel:+34605880009\">605 88 00 09<\/a>.<\/p>\n<h2>Are you sure it\u2019s a hack?<\/h2>\n<p>The clearest signs: Google or your browser warns that the site is dangerous, searching <em>site:tudominio.com<\/em> shows pages in other languages or from casinos and pharmacies, there are administrators you don\u2019t recognize, or your clients tell you the website leads them to another page (often only on mobile). We explain these in more detail in <a href=\"https:\/\/www.cint-consulting.com\/en\/the-6-most-common-wordpress-hacks-and-how-to-detect-them\/\">the 6 most common WordPress hacks<\/a>.<\/p>\n<h2>What to do in the first hour<\/h2>\n<ol>\n<li><strong>Don\u2019t delete anything yet.<\/strong> What you see (spam pages, strange files) is usually not the important part. The key is the backdoor they used to enter; deleting blindly loses the clues needed to find it.<\/li>\n<li><strong>Create a backup of the current state<\/strong>, including files and database, even if infected. This isn\u2019t for restoration but for analysis. Save it separately and mark it as infected.<\/li>\n<li><strong>Change passwords from a clean computer:<\/strong> WordPress administrators, hosting control panel, FTP, database, and the email account used to log into WordPress.<\/li>\n<li><strong>Review administrator users<\/strong> and remove any you don\u2019t recognize. Before removing them, note their username and registration date: this helps determine when the breach started.<\/li>\n<li><strong>If the website collects customer data<\/strong> (forms, registrations, store), think about your customers. If you suspect personal data has been stolen, GDPR requires you to notify the Data Protection Agency within 72 hours. If there are credit card payments, also notify your bank or payment gateway.<\/li>\n<li><strong>Notify your hosting provider.<\/strong> They can see access logs and processes that you cannot, and they may have already detected the issue.<\/li>\n<\/ol>\n<h2>What not to do<\/h2>\n<ul>\n<li><strong>Restoring the latest backup without analysis.<\/strong> The infection may have been present for weeks: if you restore a backup that was already infected, nothing is fixed.<\/li>\n<li><strong>Installing multiple security plugins at once<\/strong> and assuming the problem is resolved because the scanner shows green. Many backdoors are specifically designed to evade detection.<\/li>\n<li><strong>Deleting only visible threats.<\/strong> If the backdoor remains, attackers will return within days.<\/li>\n<li><strong>Paying a ransom demand.<\/strong> This guarantees nothing and marks you as someone who pays.<\/li>\n<\/ul>\n<h2>Afterwards: real cleanup<\/h2>\n<p>Once the bleeding is stopped, thorough cleaning is required:<\/p>\n<ul>\n<li><strong>Find the entry point:<\/strong> almost always an outdated plugin or theme, a weak password, or a plugin downloaded from an unofficial source. If this door isn\u2019t closed, nothing else matters.<\/li>\n<li><strong>Compare each file with the original<\/strong> version of WordPress and each plugin, reviewing one by one any discrepancies.<\/li>\n<li><strong>Clean the database:<\/strong> remove spam entries, intruder users, and hidden code in settings.<\/li>\n<li><strong>Update everything<\/strong> and remove abandoned plugins that no longer receive patches.<\/li>\n<li><strong>If Google marks the website as dangerous,<\/strong> request a review via Search Console (Security Issues) once the site is clean. This usually takes a few days.<\/li>\n<\/ul>\n<h2>How much does it cost to fix?<\/h2>\n<p>It depends on how far the attack has spread. That\u2019s why we always start with a diagnosis, which is free and provided on the same day: we check what happened, how they entered, and the extent of the damage. If the fix is straightforward, we do it for free when you sign up for maintenance; if it\u2019s more serious, we provide a diagnosis and a quote, with no obligation.<\/p>\n<h2>Preventing recurrence<\/h2>\n<p>Most hacks we clean could have been avoided with basic measures: controlled updates, off-hosting backups, and active monitoring. You can find the key points in <a href=\"https:\/\/www.cint-consulting.com\/en\/security-in-wordpress-8-keys-to-ensure-your-website-isnt-the-next-one\/\">WordPress Security: 8 Keys<\/a> and pricing details in <a href=\"https:\/\/www.cint-consulting.com\/en\/how-much-does-wordpress-maintenance-cost-real-prices\/\">how much WordPress maintenance costs<\/a>. And if you prefer to leave it to us, our <a href=\"https:\/\/www.cint-consulting.com\/en\/maintenance-wordpress\/\">WordPress maintenance<\/a> starts at \u20ac19\/month + VAT.<\/p>\n<p><strong>Is your website hacked right now?<\/strong> <a href=\"https:\/\/www.cint-consulting.com\/en\/website-hacked\/\">Request your free diagnosis<\/a> and we\u2019ll tell you today what\u2019s going on.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you\u2019re reading this, your website is probably doing something strange: it redirects to other pages, Google warns that it\u2019s dangerous, posts appear that you didn\u2019t write, or it simply&#8230;<\/p>\n","protected":false},"author":1,"featured_media":4484,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,170],"tags":[183],"class_list":["post-4521","post","type-post","status-publish","format-standard","has-post-thumbnail","category-sin-categoria","category-wordpress-en-us","tag-wordpress-security-en-us"],"_links":{"self":[{"href":"https:\/\/www.cint-consulting.com\/en\/wp-json\/wp\/v2\/posts\/4521","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cint-consulting.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cint-consulting.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cint-consulting.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cint-consulting.com\/en\/wp-json\/wp\/v2\/comments?post=4521"}],"version-history":[{"count":0,"href":"https:\/\/www.cint-consulting.com\/en\/wp-json\/wp\/v2\/posts\/4521\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cint-consulting.com\/en\/wp-json\/wp\/v2\/media\/4484"}],"wp:attachment":[{"href":"https:\/\/www.cint-consulting.com\/en\/wp-json\/wp\/v2\/media?parent=4521"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cint-consulting.com\/en\/wp-json\/wp\/v2\/categories?post=4521"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cint-consulting.com\/en\/wp-json\/wp\/v2\/tags?post=4521"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}