The Site Was Hacked at Night: Step-by-Step Action Plan

A midnight call or a morning message from a client: "The site redirects to porn", "Google flags the site as dangerous", "The hosting sent a hack notice". At that moment it is important to act fast and right. We have treated 350+ sites and know: mistakes in the first hours complicate recovery. Let's go through a step-by-step plan.

How to Tell the Site Was Hacked

Signs:

• Redirects — the site sends users to foreign resources.
• Google flagged it — "This site may harm your computer".
• The hosting wrote — malicious files found.
• New admins appeared — in the Joomla admin panel.
• Strange pages — in the Google index.
• Slow operation — the site lags.
• The admin panel is gone — login does not work.
• Data is missing — database, content, users.

If even one sign is present — the site may have been hacked. We act fast.

Step 1. Do Not Panic

What matters:

• Stay calm — panic hinders.
• Do not delete files — you will lose traces.
• Do not restore from backup — unless you know the cause.
• Do not change every password — diagnostics first.
• Do not take the site offline — unless you are sure it helps.
• Note the time — when you discovered it.

The first minutes are for gathering information. Not action.

Step 2. Check the Scale

What to check:

• The home page — opens or not.
• The admin panel — can you log in.
• Redirects — where it sends users.
• Google — is there a "dangerous" flag.
• The hosting — did they send emails.
• Files — were they recently changed.

Understanding the scale helps assess the severity.

Step 3. Make a Backup of the Current State

What matters:

• Save the files — a copy of the site.
• Save the database — if possible.
• Save the logs — access, actions.
• Write down the symptoms — what you see.
• Do not restore — until the cause is clear.
• Do not delete — anything from the infected files.

A backup is needed so you do not lose evidence and have a rollback option.

Step 4. Do Not Touch the Site

What not to do:

• Do not delete files manually — it can make things worse.
• Do not update Joomla — not now.
• Do not change passwords — until you know what is compromised.
• Do not reboot the hosting — you can lose traces.
• Do not restore from backup — you will lose the cause.
• Do not give access to random people — leak risk.

The best action is to do nothing until diagnostics.

Step 5. Reach Out for Emergency Help

What to do:

• Call — the phone number from Emergency Help.
• Write on Telegram — fast communication.
• Write on WhatsApp — if convenient.
• Describe the symptoms — what and when you discovered.
• Hand over access — for diagnostics.
• Mention backups — if any.

Emergency help works 24/7. Connection — 15 minutes.

Step 6. Diagnostics

What happens:

• File scanning — looking for malicious code.
• Database checks — malicious inserts.
• Log analysis — when and how the hack got in.
• Admin checks — new users.
• Hosting checks — what the server logs saw.
• Damage assessment — what is affected.

Diagnostics — 30 minutes. Then the recovery plan.

Step 7. Treatment

What is done:

• Virus removal — Virus Removal.
• Code removal — Malicious Code Removal.
• Database cleanup — removing malicious records.
• File recovery — replacing with originals.
• Password changes — after cleanup.
• Protection — Protection and Firewall.

Recovery — 2–4 hours for typical cases.

Step 8. Recovery

If needed:

• From backup — if there is a clean copy.
• Manual cleanup — if there is no backup.
• File recovery — replacing infected ones.
• Database recovery — cleaning records.
• Access recovery — if the admin panel is unavailable.
• Check — the site works.

Recovery — 2–4 hours or up to 1–2 days for complex cases.

Step 9. Protection After the Hack

What is done:

• Change all passwords — admin panel, hosting, FTP, DB.
• Firewall — Protection and Firewall.
• Joomla update — to the current version.
• Extension updates — close vulnerabilities.
• Two-factor authentication — admin panel protection.
• Monitoring — tracking repeat attacks.

Protection — so the hack does not happen again. 30-day guarantee.

Step 10. Return to Google

If the site is flagged:

• Cleanliness check — the site is virus-free.
• Search Console request — "Review site".
• Waiting — 1–3 days for the review.
• Check — the flag is removed.
• Monitoring — so it does not come back.
• Traffic returns — after the flag is lifted.

Usually the flag is lifted quickly. But sometimes — up to a week.

What Not to Do

Typical mistakes:

• Deleting files manually — can make it worse.
• Restoring from backup — without diagnostics.
• Changing passwords — before cleanup (useless).
• Updating Joomla — not now.
• Taking the site offline — losing traffic.
• Ignoring the hack — "it will go away on its own".
• Turning to random contractors — risk of data loss.

Each mistake means lost time and data.

How Long It Takes

Timeframes:

• Connection — 15 minutes.
• Diagnostics — 30 minutes.
• Treatment — 2–4 hours.
• Recovery — 2–4 hours.
• Protection — 1 hour.
• Return to Google — 1–3 days.

A typical site can be fully restored overnight.

Cost of Emergency Help

What affects it:

• Hack type — simple or complex.
• Scale — one file or hundreds.
• Urgency — night or day.
• Backup availability — simplifies recovery.
• Recovery complexity — simple or complex.

The price is fixed after diagnostics. Payment on completion.

"A hack at night is not a catastrophe. A catastrophe is not knowing what to do. Emergency help can be called at any time."

When Help Is Needed

Reach out if:

• The site is hacked or infected.
• The site redirects to foreign resources.
• Google flags the site as dangerous.
• The hosting sent a hack notice.
• The admin panel or data is missing.

We connect within 15 minutes. Start with Emergency Help or see Emergency Assistance for Agencies — all terms are there.

Quick Recap: What to Remember

• Signs: redirects, Google flag, hosting email, strange pages.
• Step 1: do not panic.
• Step 2: check the scale.
• Step 3: make a backup.
• Step 4: do not touch the site.
• Step 5: reach out for emergency help.
• Step 6: diagnostics — 30 minutes.
• Step 7: treatment — 2–4 hours.
• Step 8: recovery — 2–4 hours.
• Step 9: protection after the hack.
• Step 10: return to Google.

If your site was hacked at night — contact us. We work 24/7.