Your Business Website Was Hacked. Here Is What to Do Right Now.

You opened your website and your stomach dropped. Maybe the homepage now shows a sketchy ad for pharmaceuticals you have never heard of. Maybe Google is showing a red warning page when anyone tries to visit. Maybe your site is just gone, replaced with a black screen and a message demanding payment. Whatever it looks like, the situation is the same. Your business website has been hacked, and right now every minute it stays compromised is costing you trust, traffic, and customers.

Take a breath. This is fixable. Here is exactly what to do, in order, starting in the next five minutes.

Step One: Take the Site Offline Immediately

The first priority is stopping the bleeding. As long as a hacked site is live, it is potentially infecting visitors, hosting malicious content, harvesting credentials, or sending spam through your mail server. Every visitor that lands on it is at risk and every search engine impression is being damaged.

If you have access to your hosting dashboard, put the site into maintenance mode or take it offline entirely. If you do not, contact your hosting provider's support and tell them your site has been compromised and needs to be temporarily disabled. Most hosts will do this within minutes. A site that is offline is safer than a site that is actively spreading damage.

Step Two: Change Every Password Tied to the Site

Assume every password related to your website has been exposed. That includes your hosting account, your domain registrar, your email associated with the site, your content management system login, your FTP credentials, and any platform admin accounts. Change them all. Do it from a device you trust, not the one that may have been compromised.

Use long, unique passwords for each one and store them in a password manager. If two factor authentication is available on any of these accounts, enable it now. The hacker likely got in through one weak credential, and reusing the same password across services is the single most common cause of small business site breaches.

Step Three: Contact Your Hosting Provider

Your host has visibility into what your site has been doing that you do not. They can tell you when the breach happened, what kind of malicious activity has been occurring, whether it spread to other sites or services, and whether your specific environment can be cleaned or needs to be rebuilt. Some hosts include malware cleanup as part of their plan. Most charge for it as an emergency service.

Be honest about what you can see. Send them screenshots of any defaced content. Ask for a clean backup of your site from before the breach if one exists. Many small business sites do not have recent clean backups, which is part of why hacks become so painful so fast.

Step Four: Tell Google About the Hack

Once your site is offline and credentials are changed, log into Google Search Console. If you do not have it set up, set it up now. Search Console will show you any security warnings Google has placed on your site, malicious URLs it has detected, and steps to request a review once the site is cleaned. Until that review happens, Google may keep showing the red warning page to anyone trying to visit, even after you fix the problem.

This is also where you find out how badly your search rankings have been affected. Most hacked small business sites lose significant ranking visibility within days of the breach. The longer the malicious content stays indexed, the longer the recovery takes.

Step Five: Decide Between Cleanup and Rebuild

There are two ways out of a hacked site. Clean the existing site or rebuild it on fresh infrastructure. Cleaning is cheaper in dollars but expensive in risk. If the malicious code is buried in obscure files, in your database, or in a plugin you forgot you installed, traces can survive a cleanup and reinfect the site weeks later. This is one of the most common second wave problems small businesses run into.

Rebuilding on fresh, secure hosting from scratch eliminates the uncertainty entirely. There is no chance of a hidden backdoor surviving the move because nothing is being moved. Only verified, clean content gets transferred. Most small business owners do not consider this option because they assume it costs as much as the original build. With the right operator, it does not.

How Most Small Business Sites Get Hacked in the First Place

Understanding how it happened helps prevent it from happening again. The most common causes are outdated plugins on platforms like WordPress, weak or reused passwords, hosting providers with poor security practices, abandoned admin accounts from former employees or contractors, and themes downloaded from untrusted sources. Once one of those gives a hacker an opening, the rest of the site is exposed.

This is why moving to secure, managed infrastructure on AWS removes most of the attack surface entirely. There are no random plugins running. No outdated themes. No shared hosting environment where another site's compromise can become your problem. The architecture itself is more secure by default.

How Cannone Marketing Rebuilds After a Hack

One time $199 setup. $49 per month. No contracts. Cancel anytime. After a hack, the fastest path back to a safe, professional online presence is a clean rebuild rather than a risky cleanup. Cannone Marketing builds every site fresh on AWS, which provides the reliability and uptime of the world's leading cloud platform. There are no abandoned plugins, no outdated themes, and no shared environment risks to inherit.

The new site is custom designed and includes a dedicated page for every service the business offers and every city served. FAQPage and Service schema is built into every page. Your Google Business Profile is fully managed, and Search Console reconsideration requests get filed quickly so search rankings start recovering. 100 QR coded review cards ship to your door so review velocity rebuilds along with the site. Every update is handled directly by Mike Cannone through Worry-Free Support.

The breach becomes a turning point instead of a recurring nightmare. The site that comes back is more secure, faster, and built to compete locally rather than just exist online.

Frequently Asked Questions