What to do if your website is hacked or defaced

Website compromises take several forms: visible defacement, spam pages or links injected for search engines, redirects to scam sites (often only for mobile users or visitors arriving from Google), malicious scripts that steal card details at checkout, or a new admin account you didn't create. Some only show to certain visitors, so test from a phone on cellular data and by searching 'site:yourdomain.ca' in Google to see what pages it has indexed.

Take screenshots and save copies of affected pages with the date and time. If Google has flagged the site, the Security issues report in Google Search Console will list what it found and sample URLs.

Before restoring a backup or letting a host 'clean' the site, collect: web server access and error logs, the CMS's own activity or audit log, hosting control panel and FTP/SFTP logs, a full copy of the site files and the database as they are now, and a list of admin users with their last sign-in dates.

Hosting companies often keep logs for only days or weeks. Ask your host for them in writing. Without logs, nobody can say how the attacker got in or whether customer data was taken.

• Rebuild from a known-clean source where possible: fresh CMS core, plugins and themes from the official source, then your content.
• Remove unknown admin users, files and scheduled tasks; check for web shells in upload folders.
• Update everything and remove plugins you don't use.
• Rotate every credential: CMS admins, database, hosting panel, FTP/SFTP, API keys and payment gateway keys.
• Turn on MFA for CMS admin and hosting accounts.
• Add a web application firewall and file-change monitoring.
• The Canadian Centre for Cyber Security's baseline controls for small and medium organizations cover patching, MFA and secure configuration for exactly this kind of asset.

If Google has labelled the site as hacked or dangerous, browsers and search results may warn visitors away. After cleaning, use the Security issues report in Search Console to request a review, describing what you fixed. Google says reviews of sites hacked with spam can take several weeks; malware reviews are usually faster. Also remove spam URLs that were indexed, and check that no unfamiliar owners were added to your Search Console property.

If the site collects personal information (contact forms, accounts, bookings, payments), work out whether the attacker could read it. Skimming code on a checkout page, a downloaded database or access to form submissions can all amount to a breach of security safeguards. Payment card compromises may also have to be reported to your payment processor under your merchant agreement.

Assess whether there's a real risk of significant harm to individuals, report and notify if so, and record the breach either way. Call the 24/7 line at (289) 582-9930 if you need logs analyzed or evidence preserved.