Treat the warning as a reason to act, not a diagnosis
A browser warning, strange search result, unexplained redirect, or message from a visitor may point to a compromise. It may also have another cause, such as a broken plugin or an outdated search listing. Record exactly what you noticed, when you noticed it, and which pages or accounts appear affected. Take screenshots of warnings and unfamiliar content. Avoid repeatedly opening a suspicious page on your everyday computer just to confirm that it still looks wrong.
Decide who needs to know right away. If a freelancer, host, or small team maintains the site, appoint one person to coordinate changes and keep a simple timeline. This prevents several well-meaning people from overwriting clues or undoing each other’s work. If the site handles orders, account logins, or submitted personal information, treat the situation as more urgent than a cosmetic page change.
Limit harm while preserving useful evidence
If visitors might encounter malicious content, consider temporarily putting the affected site or pages into maintenance mode. Ask your hosting provider for help if you cannot do this safely. A maintenance notice should be brief and factual; you do not need to declare that an attack occurred before you understand what happened. If only one feature is affected, disabling that feature may be less disruptive than taking down the entire site.
Before deleting files or restoring a backup, save what you reasonably can: recent server and application logs, a copy of affected files, a list of installed extensions, and a database backup if you know how to make one safely. Your host may be able to preserve a snapshot. Keep these copies separate from clean backups and label them as potentially unsafe. Evidence can help identify what changed and whether the same problem might return after a restore.
Secure the accounts that control the site
Use a device you believe is safe to change passwords for the hosting account, website administrator accounts, domain registrar, and any connected deployment or backup services. Secure the email accounts used to reset those passwords too. Choose unique passwords, enable multifactor authentication where available, and review active sessions and recovery settings. If you suspect a particular computer is compromised, do not use it to set new credentials.
Look for administrator accounts you do not recognize and remove their access after documenting what you found. Review who can edit the site and reduce permissions that are no longer needed. If the website uses API keys, database credentials, or other stored secrets, plan to replace them as part of recovery. Changing a password alone will not remove a malicious file or fix the weakness that allowed it to appear.
Find the likely entry point before restoring
Check the areas most likely to reveal an unwanted change: recently modified files, new users, unfamiliar plugins or themes, scheduled tasks, redirects, and changes to site settings. Compare the site with a known-good backup if you have one. Review updates that were pending, but do not assume an outdated component was the cause without supporting evidence. For a small site without in-house technical help, the host or a qualified incident-response specialist may be the fastest route to a reliable assessment.
A backup is useful only if it predates the problem and can be restored safely. Restoring an older copy without fixing the entry point may bring the site back briefly and leave it exposed again. Make a recovery plan that covers cleaning or replacing affected files, removing unauthorized accounts, updating supported software, rotating credentials, and testing forms, logins, and key pages before reopening the site.
Reopen carefully and keep watching
Once the site is clean and working, check it as a visitor would on more than one device. Confirm that redirects go where expected, pages load without warnings, and contact or purchase flows work if your site has them. Monitor logs, file changes, user accounts, and any security alerts more closely for a while. Keep a record of what you changed so you can investigate quickly if a symptom returns.
If visitor information may have been exposed, determine what happened and seek appropriate guidance on any notification obligations; requirements depend on the circumstances and location. Communicate clearly without guessing about the scope. After the immediate work, improve the routine that would have made this easier: tested backups, timely updates, limited account access, and a short written response checklist. The goal is not to promise that an incident cannot happen again, but to make the next warning easier to handle.
