RunCabin Blog · Fix-it guide

My business website got hacked. What do I do?

October 28, 2026 · 8 min read

Lock the accounts first, then call your host, then clean, then ask Google to take the warning down. In that order. Most owners do it backwards: they find a stranger on the internet to "remove the virus" while the password that let the attacker in still works, and they are back where they started in a week. A hacked local-business site is a bad day, not the end of the business, and the fix is a short list of boring steps.

One note before the list: if you have not seen the problem with your own eyes, and a caller is the one telling you your site is hacked, hang up and go look. More on that further down.

How owners usually find out

Almost nobody notices it from the inside. The site looks fine when you type your own address, because a lot of attacks are built to hide from the owner. You hear about it one of these ways:

• Google says "This site may be hacked" under your listing in the search results, or your listing shows titles in Japanese or for products you have never heard of.
• Chrome shows a full red page that says "Dangerous site" or "Deceptive site ahead" before your homepage loads. That is Google Safe Browsing, and it is a wall: almost nobody clicks past it to hire a roofer.
• A customer tells you they clicked your link from Google and landed on a pharmacy, a casino or a fake prize page. Often the redirect only fires for visitors who arrive from a search, which is exactly why you never see it.
• Your host suspends the account or emails you that your site is sending spam or using too much of the server.
• Google Search Console emails you about a security issue, if someone set it up. If nobody did, here is why it is worth the ten minutes.

If what you are seeing is the words "Not secure" in the address bar, that is usually a different and much smaller problem, an expired certificate, and it has its own fix. If the site simply will not load, start with how to tell whether it is down.

The first hour, in order

1. Change the passwords that control the site. Four of them: the hosting account, the website's own admin login (on WordPress that is the /wp-admin page), the domain registrar where you bought your address, and the email account that receives the reset links for all three. That last one matters most, because whoever controls that inbox can reset everything else. Use new passwords you have never used anywhere, and turn on two-step sign-in everywhere it is offered.
2. Check who else has a login. In the site's admin, look at the list of users. An administrator account you do not recognize is a common calling card, and so is a former employee or old web designer who still has full access. Remove anything you cannot explain.
3. Call or open a ticket with your host. Say plainly that the site was compromised. Ask three things: do you have a backup from before this started, can you see how they got in, and is my account sending spam. Many hosts can restore a dated backup in minutes, and some include a malware scan. They also see server logs you cannot.
4. Do not delete everything in a panic. Wiping it throws away the evidence of how they got in. Let the host restore over it, or take a full copy first.
5. Restore a clean copy, then close the hole. A backup from before the attack puts the pages back, but the outdated plugin or theme that let them in comes back with it. Update everything immediately after restoring, and delete any plugin or theme you are not actively using. Deactivated is not deleted; inactive plugins can still be exploited.

If there is no clean backup, the host cannot help, and nobody maintains the site, skip ahead to the clean-or-replace section, because that is now the real decision.

Getting the Google warning taken down

Google does not lift the label on a timer. It lifts it after it reviews the site and finds it clean, and you have to ask.

1. Add your site to Google Search Console if it is not there already. You will need to prove you own the domain, usually with a record your host or registrar can add.
2. Open the Security Issues report. It lists what Google found and gives sample pages. Fix every item on it, not just the homepage. Hacked spam often lives in hundreds of pages you never made.
3. Click Request Review and describe, in a few plain sentences, what you removed and how you closed the hole ("restored a clean backup from September 30, updated all plugins, removed two unused plugins, reset all passwords, removed an unknown admin user").

Google's own help page says a review can take from a few days to a few weeks. Malware reviews tend to move faster than hacked-spam reviews, which can need the affected pages reprocessed. Google also warns that asking for a review before the problem is fully fixed can slow down the next request, so be thorough the first time rather than fast.

Is customer information at risk?

For most local trade sites, less than you fear, but it depends on what the site stored. A plain brochure site with a quote form that emails you and saves nothing has very little to steal. A site that keeps form submissions in its database, takes payments on its own pages, or has customer logins is a different story.

Ask your host or whoever cleans the site a direct question: did the site store names, addresses, phone numbers or payment details, and is there any sign those files were read or copied? If the answer is yes or maybe, talk to a lawyer before you decide what to tell anyone, because every state has its own rules on when a business has to notify people about a breach. Payments taken through Stripe, Square or a similar processor usually never touch your site, which is one more reason to keep it that way.

Why it happened to you

Almost always, nobody chose you. Bots scan the internet around the clock looking for known holes in common software, and they break into whatever answers. The goal is rarely your business. It is your site's good standing with Google, which attackers borrow to rank pages for pills, casinos or knockoff goods, or your server, which they use to send spam.

The software they look for is mostly WordPress plugins and themes. Patchstack, a WordPress security company, counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025 and attributed 91 percent of them to plugins, with only six in WordPress itself. WordPress is not the villain here. An old site with a page builder, a slider, a contact form plugin, a gallery plugin and a dozen others, none updated since the designer moved on, is simply the most common shape of a site with an open door.

That is also why this keeps happening to the same kind of owner: the one whose site was set up years ago by a nephew or a freelancer who is no longer answering. If that is you, getting control of your domain and hosting back is step zero.

Watch out for the "we noticed your site is hacked" call

A hacked site is a gift to cold callers, and so is the fear of one. The script is that your site has malware, Google is about to delist you, and their team can clean it today if you pay now and give them your login.

Owners in the trades already know the pattern. As one poster on an HVAC forum put it, "about 10 minutes after your business site goes live people will start calling and emailing about SEO services." The security version is the same call with scarier words. Two rules: never pay to fix something you have not seen yourself in your own browser or in Search Console, and never hand a login to someone who called you. There is more on the genre in why these calls flood a new business.

Clean it or replace it?

This is the honest question most owners never get asked.

Clean it if the site is fairly new, somebody actually maintains it, the host had a clean backup, and you like the site. Restore, update, request a review, set up automatic updates and move on.

Replace it if the site is years old, nobody updates it, you could not log in to it last week without a password reset, and you were paying for hosting mostly out of habit. Cleaning that site resets the clock, but the same unpatched software is still sitting there for the next bot. You are signing up to pay for this again, or to become the person who logs in every month to click Update.

If you replace it, keep your domain. Your address, your Google Business Profile link, your truck lettering and years of search history all point at that name, and none of it is tied to the old hosting. Point the domain at the new site, check that the old pages people search for still lead somewhere sensible, and only then let the old hosting lapse. There is a fuller walkthrough of the ranking side in will a new website hurt my Google ranking.

Telling customers

If the red warning was up for a day or two, some customers saw it. A short, calm note does more good than silence: a post on your Google Business Profile and Facebook page saying your website had a technical problem, it has been fixed, and the phone number has not changed. Skip the details.

A short prevention list

• Two-step sign-in on the hosting account, the domain registrar, the site admin and the email behind them.
• Automatic updates turned on, and every plugin or theme you do not use deleted.
• Backups you have personally confirmed exist and are kept somewhere other than the site itself.
• Google Search Console set up, so Google emails you instead of a customer telling you.

Where RunCabin fits

RunCabin builds and runs the site for a build starting at $499, then $39.99 a month, and the part of this post that is about maintenance is on our side of the line. Your site is built lean, with no plugin stack for you to keep patched and nothing for you to log in and update. HTTPS is on from the first day, your quote form sends to your email, and keeping the hosting current is our job rather than a chore on your list. No website company can promise nothing will ever go wrong, but we can make sure the most common open door on small business sites is not sitting there in the first place.

If you are replacing a hacked site, you answer a short planner, send your photos, and see a first version within 24 hours of sending them. Your domain and hosting are included with no long contract, and the domain is yours: we release it to you free, with the transfer code, whenever you ask.

---

Related reading: why does my website say "Not Secure" · my web guy disappeared, how do I get control of my website · is my website down