My Business Website Got Hacked. What Do I Do Now?

The short answer

If your business website was hacked, do not panic and do not start deleting files. Change every password tied to the site (hosting, website admin, email, and domain registrar), call your hosting company, and then either restore a clean backup or have a professional clean the site. After that, close the hole that let them in, which is usually outdated software or a weak or reused password, and ask Google to review the site if it was flagged.

A hacked site is fixable, and most small business hacks are cleaned up within a few days. The owners who get into real trouble are the ones who ignore it for weeks or try random fixes that destroy the evidence of how the attacker got in.

How do I know my website was hacked?

Hacks are often designed to hide from the owner. Many only show the bad behavior to visitors on phones, or only to people who arrive from Google, so you can type your address into your office computer and see a perfectly normal site. Here are the signs I see most often:

• Visitors get redirected to spam, gambling, or scam sites, often only on phones or only when they click your listing in Google.
• Your Google results show pages you never made, such as Japanese text or pharmacy and pill spam listed under your domain name.
• Google or Chrome shows a red 'Deceptive site ahead' screen, or your search listing says 'This site may be hacked.'
• Your hosting company suspends your account or emails you about malware, which is software planted to do harm.
• New admin users appear in your website dashboard that you did not create.
• Email from your domain starts bouncing, or customers say your messages are landing in spam.
• A customer calls to say your site sent them somewhere strange. Take that call seriously, even if it looks fine to you.

What to do in the first hour

The goal of the first hour is to lock the attacker out and stop the damage from spreading. You do not need to understand the technical details yet. Work through this list in order:

• Change your hosting account password first, then your website admin password, then your email passwords, then your domain registrar password (the company where you bought your domain name).
• Use a new, unique password for each one. If the old password was used anywhere else, change it there too.
• Turn on two-factor login everywhere it is offered. That is the extra code sent to your phone when you sign in.
• Call or open a ticket with your hosting company. Ask whether they see malware, whether they have recent backups, and how far back those backups go.
• Check your website admin for user accounts you do not recognize, and write down their names before you delete anything.
• Do not delete random files or reinstall things blindly. That can wipe out the clues that show how they got in, and the hole stays open.
• If you have a web designer or IT person, call them now and give them the details you have collected.

How much does it cost to fix a hacked website?

There are three realistic ways out, and the right one depends on how old the site is and how badly it was hit.

Restore a clean backup. If your host or designer has a backup from before the hack, restoring it can be the fastest and cheapest fix, sometimes free. The catch is you have to know the backup is clean, and you still have to fix the weakness or the attacker walks right back in, often within days.

Pay for a professional malware cleanup. Professional cleanup typically runs roughly $200 to $1,000, depending on how many files were infected, how many spam pages were created, and whether the site was blacklisted by Google. A good cleanup includes finding the entry point, not just deleting the visible junk.

Rebuild the site. If the site is several years old, running software nobody has updated in a long time, and was badly compromised, cleaning it can cost nearly as much as starting fresh, and you end up with the same old site that got hacked. For a Columbus business with a ten year old WordPress site, a rebuild is often the more honest answer.

Getting Google to trust your site again

Cleaning the site is only half the job if Google already flagged it. Sign in to Google Search Console, the free Google tool that shows how your site appears in search, and open the Security Issues report. If it lists problems, fix them, then click the button to request a review. Google reviews usually take a few days, and sometimes longer.

Next, search Google for site:yourdomain.com (using your real domain) and scroll through the results. Leftover spam pages often stay listed for a while, and you want to confirm they now return a 'not found' page instead of junk. Finally, open your Google Business Profile and make sure the website link still points to your real site. Say a homeowner in Westerville finds you on Google Maps to book a furnace repair. That link is how they reach you, so it has to be right.

How to keep it from happening again

Here is the honest truth: most small business websites in Central Ohio are not hacked because someone picked them out. They are hacked by automated programs (bots) that scan millions of sites a day looking for outdated software and easy passwords. A plumber in Grove City and a bearings distributor in Hilliard look exactly the same to those bots. That is good news, because it means simple, boring habits stop most attacks.

• Keep the website software, theme, and plugins (the add-on features) updated, ideally automatically.
• Delete plugins you do not use and remove old admin accounts, such as a former employee or a designer you no longer work with.
• Use strong, unique passwords and two-factor login on hosting, admin, email, and your domain registrar.
• Keep automatic backups stored off-site, meaning somewhere other than the same server as your website.
• Use managed hosting with security monitoring, so someone is watching for trouble before your customers notice it.

If keeping up with updates and backups is not something you want on your plate, that is reasonable. Most business owners would rather run their business. This is exactly what secure managed hosting with updates and backups is for, so a forgotten plugin update does not turn into a weekend of cleanup.

What if customer information was exposed?

If your site collected customer details, such as names and addresses from quote forms, account logins, or payment information, a hack can raise legal questions about whether you have to notify those customers. I am a web designer, not a lawyer, so I will not tell you what the rules require. If there is any chance customer or payment data was exposed, talk to an attorney before you send anything out.

For most Columbus and Central Ohio service businesses, the website does not store card numbers, because payments go through a separate processor. But it is worth asking that question early rather than finding out later.

Frequently asked