English
Magyar
Did you know that in Hungary, the number of reported data protection incidents rose by more than 25 per cent in a single year, and that in 97 per cent of cases, attackers now simply log into systems using stolen passwords rather than hacking them? When you’re faced with error messages on your own platform or find yourself on Google’s blacklist, panic and the fear of data loss are perfectly natural human reactions. Nobody wants their business to suffer long-term damage from a loss of revenue due to business disruption or a loss of trust.
This guide has been created to provide calm and professional assistance when you’re in trouble. By systematically outlining the most important steps to take following a website hack, we help you not only to put out the immediate fire, but also to regain full control over your digital assets. You will learn the precise technical steps for isolating the infection, the process for securely restoring your data, and how to permanently patch security vulnerabilities, so that your website can continue to operate reliably on a clean and stable infrastructure well into 2026.
What to do after a website hack: An immediate damage control protocol
When you realise you’ve been the victim of a successful attack, your adrenaline levels will spike, but panicking will only make matters worse. The most important step to take after a website has been hacked is always to isolate the problem. If you do not shut down the processes immediately, the malicious code may continue to spread across the server, infecting other directories or even the database. Quarantine the website: activate maintenance mode, or if the infection is severe, temporarily take the site offline. This will prevent visitors’ devices from becoming infected and stop the site from being blacklisted by Google, which, even in 2026, remains the quickest way to lose traffic.
Statistics from 2025 revealed that 97 per cent of identity-based attacks were carried out using stolen passwords. For this reason, the first technical step must be to immediately change all access credentials. This does not only apply to the website’s administration panel. You must also change the login details for FTP, SSH, the database and the hosting control panel, such as cPanel. Notify your hosting provider as soon as the issue is detected. A well-prepared provider will be able to view the server logs and help identify the exact source or time of the attack, which is essential for a proper recovery later on.
Restricting and auditing access
Carefully check the list of FTP and SSH users. Attackers often create their own backdoors so that they can regain access to the system at any time, even after the password has been changed. If you find an unknown account, delete it immediately. After changing the database password, do not forget to update the configuration files; for example, the wp-config.php file in the case of WordPress. Wherever possible, implement two-factor authentication (2FA). This is the simplest and most effective way to prevent unauthorised access in the future, even if the password were to be leaked in some way.
Isolating the infection at server level
During the clean-up process, it temporarily restricts write permissions on the file system. If the files cannot be modified, the malware cannot rewrite itself or spread further whilst you are attempting to clean up the system. Force-close all active sessions to immediately terminate the attacker’s current connection. If a specific, suspicious IP address appears in the log files, block it using the .htaccess file. This forms the basis of proactive defence, particularly if you are working in a Linux VPS environment, where you have full control over the server settings. This phase of the post-hack recovery process clears the way for the actual virus removal and the restoration of backups.
Diagnosing the infection: How did the intrusion happen?
Once the system has been successfully isolated, the investigation takes centre stage. If the exact point of intrusion is not identified, the attacker will be back inside the system within minutes of a clean backup being restored. The first step in the diagnosis is to record any visible anomalies. Common signs include unwanted redirects to unfamiliar, often dubious, websites, or ad banners and pop-ups appearing unexpectedly on the site. Scan the file system for files with suspicious names. Files such as “class-wp-cache.php” (which is not part of the core system) or .php files consisting of incomprehensible character strings almost certainly act as backdoors.
The next step in a technical deep dive is to check the modification date (mtime) of files. If you see a file with a recent date in a directory that hasn’t been touched for months, this should immediately raise suspicion. In addition to manual searches, it is essential to run professional malware scanners. When it comes to the steps to take following a website breach, a server-level scan is one of the most effective tools. A modern cPanel hosting platform usually includes a built-in antivirus, but advanced defence systems such as Imunify360 delve deeper into the code structure as well.
The most common security vulnerabilities in 2026
Trends for 2026 indicate that attackers are increasingly relying on automated bots. Although WordPress 7.0 came with modern security features, CMS systems and plugins left running on outdated versions remain the number one target. Particularly dangerous are ‘nulled’ premium themes – that is, those that have been illegally cracked. Almost without exception, developers inject malicious code into these before they are distributed. Brute-force attacks have also evolved: against AI-based password crackers, weak passwords cannot survive even a single hour without protection.
Reading log files for beginners
Raw access logs are the most helpful for accurately reconstructing the attacker’s path. You can find these in the Metrics section of the cPanel interface. Look for unusual POST requests, particularly those pointing to unknown .php files, or returning a series of 200 (successful) status codes in directories where there should be no traffic. If analysing IP addresses or interpreting logs seems too complicated, aWh’s knowledge base and team of experts can help you make sense of the data to ensure that this stage of the post-breach recovery process is also successful.
Restoration and clean-up: Rebuilding the website
Once the diagnosis has been made, you reach the most critical decision point: should you try to clean up the code manually, or restore the whole site to a previous state? Experience shows that, of all the steps to take after a website has been hacked, manual code cleaning is the riskiest. A single overlooked piece of malicious code or a hidden cron job is enough to re-infect the website within hours. In contrast, using a professional website backup is the quickest and safest route to recovery, as it guarantees a fresh start from a clean base.
If a backup is not available, during manual cleaning you must focus not only on the file system but also on the database. Attackers often create new users with administrative privileges directly within the SQL tables. Check the list of users and delete any suspicious profiles. Look for unauthorised scripts in your template files, particularly in the header.php and footer.php files, where malicious JavaScript code is most commonly hidden. Remember, the clean-up is only effective if you have already patched the security vulnerability identified during the diagnosis.
Restore from a clean source
The key to a successful recovery is selecting the right backup point. Look for a date that is at least 24–48 hours before the first suspicious signs were detected. The JetBackup tool, available on modern cPanel hosting interfaces, allows you to restore not only files but also databases in a synchronised manner with a single click. This is essential, as if the file system is clean but the infection remains in the database, the problem will immediately reoccur. Immediately after the restore, run a full server-side malware scan to be on the safe side.
Removal from Google’s blacklist
It’s no use having a clean site if visitors are still greeted by the red warning screen. The final technical step in the post-hack recovery process is to be removed from Google’s Safe Browsing list. Log in to Google Search Console and, under the ‘Security Issues’ menu item, request a review of your site. Provide details of the steps you have taken to remedy the situation. Google’s systems usually process the request within 24–72 hours. You can also check the status using external tools, such as Sucuri SiteCheck, to ensure the site is completely clean.
How can you prevent the next attack? Security protocols
Following a successful recovery, the most important task is to establish future-proof protection. The series of steps to be taken after a website has been hacked can only be considered complete once the system has become more resilient than it was before the attack. In the cybersecurity landscape of 2026, mere hope is no longer enough to defend against AI-based automated attacks. Developing a deliberate update strategy is the first step: using WordPress 7.0 and the latest PHP versions is essential not only for speed but also for critical security patches. In addition to keeping plugins and themes up to date, setting up a Web Application Firewall (WAF) filters out suspicious traffic before it even reaches the server.
Encryption is the cornerstone of a secure data connection. Many people forget that a valid SSL certificate not only boosts visitors’ trust but also prevents login details from being intercepted on public networks. Regular security audits and automated, scheduled malware scans, meanwhile, enable you to detect even the slightest suspicious file modification immediately, before it causes serious disruption to business operations. According to data from 2025, 97 per cent of attacks are carried out using stolen passwords; therefore, making two-factor authentication (2FA) mandatory for all administrator accounts is one of the most effective lines of defence.
Hardening: Securing your website
When ‘hardening’ your website, tighten the file write permissions on the server. The ideal setting is chmod 755 for directories and chmod 644 for files, which prevents external scripts from modifying the files. Hiding administrative interfaces, such as wp-admin, or restricting access based on IP addresses drastically reduces the success rate of brute-force attacks. Remember, software-based protection is only effective when built on a stable foundation. A modern, well-maintained SSD hosting environment and an up-to-date software stack provide the technological backbone that allows security features to operate without delay.
Automated backup systems
The backup is not merely a file, but the key to a business’s survival. In line with the requirements for 2026, daily, weekly and monthly backups must be stored at separate, physically distinct locations. The integrity of backups must be verified through regular test restores, as a corrupted backup is of no use in an emergency. In aWh’s systems, these processes can be fully automated, so you do not have to bother with manual exports. If you really want to be sure your data is secure, choose an infrastructure that supports these protocols by default.
Protect your business with state-of-the-art tools and choose from our secure web hosting plans for complete peace of mind.
The basic requirements for secure hosting, as seen by aWh
Whilst carrying out the necessary steps following a systematic website breach, many website owners find that their previous hosting provider did not offer sufficient technical support when they needed it most. At aWh, we have over 10 years’ experience in managing and preventing cyber security incidents. We know that every minute counts following a successful attack, which is why we have built our NVMe-based infrastructure. This technology not only enables websites to load at lightning speed, but also drastically reduces the time taken for security scans and comprehensive recovery processes, thereby minimising business downtime.
Alongside our technological infrastructure, human expertise is our greatest asset. Our expert support team does not respond to enquiries with boilerplate answers; we understand the language of server logs and help identify points of intrusion. The security measures integrated into our servers, such as multi-layered hardware firewalls and brute-force protection, continuously filter out suspicious traffic. Meanwhile, our isolated environments ensure that your digital assets remain completely secure, even in the event of incidents affecting other users.
Why choose us if security is your top priority?
We provide immediate assistance and technical support in critical situations, as we are well aware of the risks involved in being blacklisted by Google. A free SSL certificate is included as standard with all our hosting plans, so secure, encrypted communication comes at no extra cost with us. We continuously update our server-side software – including PHP and MySQL versions, as well as the cPanel hosting environment – with the latest security patches, so that you can focus solely on building your business.
Our featured solutions for businesses
Among our solutions tailored to specific needs, managed WordPress hosting takes pride of place, protecting the most popular content management system with extra layers of security against CMS-specific attacks. For businesses requiring maximum isolation and dedicated resources, our KVM VPS plans are the perfect choice. Here, hardware-level virtualisation ensures that only you have access to the server’s resources and file system, providing the highest level of digital security.
Don’t wait for trouble to strike! Switch to secure aWh hosting today!
Digital security in 2026: Take the first step towards proactive protection!
A website hack is a critical situation, but with the right methods, the damage can be fully rectified. Carefully following the steps detailed in our guide on what to do after a website hack will not only eliminate the current infection but also help you avoid being blacklisted by Google and suffering a significant loss of business revenue. The most important lesson is that, rather than relying on manual clean-up with an uncertain outcome, restoring from a clean backup and systematically strengthening server-side protection represent the genuine, long-term solution.
Don’t let a security breach jeopardise your business’s future and your customers’ trust. aWh’s more than 10 years of professional experience and our lightning-fast, secure NVMe SSD-based servers guarantee technological superiority in every situation. Should you ever get stuck during the recovery process, our 24/7 expert support is on hand even in the most difficult moments to ensure your systems are secure once again.
Protect your website with professional aWh hosting!
Start building your secure digital presence today, and sleep soundly knowing that your data and business operations are hosted on state-of-the-art infrastructure.
Frequently asked questions about website security and recovery
How can I be sure that my website has been hacked?
Some of the most obvious signs include Google’s red warning screen, redirects to unfamiliar websites or unexpected error messages. If you see unknown .php files on your hosting account, or new administrators appear in the control panel that you did not create, you can be certain that there has been a breach. Attacks in 2026 often remain invisible on the surface, so it is worth checking your server logs regularly to identify any unusual traffic.
How much does it cost to clean up a hacked website?
The cost of recovery in Hungary varies depending on the nature of the fault and the extent of the infection. Based on market data, a general troubleshooting and repair job can cost between 70 and 140 euros, whilst a full security update ranges from 55 to 110 euros. However, one of the most cost-effective steps to take following a website breach is to focus on prevention and maintaining a robust backup system, which can help avoid both these costs and business downtime.
Is my customers’ data at risk following a hack?
Yes, the security of customer data may be directly compromised in such cases, particularly if the attackers have also gained access to the database. Under Article 33 of the GDPR and Hungarian legislation, a data breach must be reported to the authorities if it poses a risk to the rights of natural persons. In Hungary, the number of reported cases rose to 678 in 2025, which highlights the importance of data controllers’ responsibilities following a technical incident.
Does the web hosting provider help with website recovery?
The level of support provided depends on the provider, but ensuring the technical infrastructure is in place is a fundamental requirement. At aWh, we provide expert support and professional tools such as JetBackup, which allows the recovery process to be carried out in a matter of minutes from a clean source. We also assist with the analysis of log files to identify the exact source of the attack, but the manual cleaning of the website’s code is usually the responsibility of the owner or a developer.
Why was I hacked if I had a security plugin?
Security plugins provide only a single layer of protection and do not offer a comprehensive guarantee. 97 per cent of attacks are carried out using stolen passwords, against which even the best plugin is powerless if two-factor authentication (2FA) is not enabled. Furthermore, security vulnerabilities often lie in outdated PHP versions or hosting-level configuration errors, which plugins cannot patch.
How can I ask Google to remove the warning from my site?
You can request the removal of the warning via the Google Search Console interface under the ‘Security Issues’ menu item. Once you have carried out a full clean-up and are satisfied that the site is clean, submit a review request. In this, briefly outline the measures you have taken and how you have closed the security vulnerabilities. Google’s systems usually take between 24 and 72 hours to process the request.
Is it enough just to change your passwords after an attack?
No, changing your password is merely a stopgap measure and does not provide a permanent solution. If the attacker has planted backdoors in the file system or database, they can regain access to the system in a matter of minutes, even with the new password. When dealing with the aftermath of a website breach, the first step is to thoroughly remove all infected code and suspicious users; only after the system has been completely cleaned should all access credentials be changed.
How often should you back up your data?
For business websites and online shops, daily backups will be an absolute essential in 2026. In modern hosting systems, this process can be fully automated, ensuring that a clean state is available without the need for human intervention. It is important to store backups at a location physically separate from the server and to regularly check their integrity by performing test restores, to ensure that, in the event of a problem, you can actually recover functional data.