The call usually comes on a weekday morning, and it rarely starts with the word "hacked." A board member says the website "went somewhere weird" when she clicked it from her phone. A customer forwards a screenshot of a search result showing your organization's name next to a listing for discount pharmaceuticals. Your browser greets your own homepage with a red full-screen warning calling it a deceptive site. Or a security plugin you forgot you installed sends an email with a subject line you read three times.
However it arrives, the next sixty minutes decide whether this is a bad week or a bad quarter. The organizations that come through it well are not the ones with the most technical staff; they are the ones that do a short list of things in the right order and resist three very natural instincts. This post walks through that hour step by step, because the order is most of the answer, and then covers the rest of the week.
What usually happened
Just this year, several of my clients have hired me to clean up hacked WordPress sites. In one, a single outdated plugin handed the attacker a file manager: full access to open any file on the site, change it, and write straight into the database. Nobody targeted that organization. A bot scanning the web for that plugin's known weakness found it, did its work, and moved on.
That is the normal shape of a small-site compromise. The plugin's vulnerability was published months earlier, the update that fixed it sat unapplied, and the damage stayed invisible from the homepage for weeks. By the time anyone noticed, it had reached the site's structure, its search standing, and the trust the organization had spent years building. Understanding that it was automated matters for one practical reason: it means you do not need to figure out who did this. You need to figure out how they got in and close it.
The wrong first moves
Three instincts arrive within minutes, and all three make the week longer.
The first is deleting things. You open the file manager, see files with strange names, and start removing them. Those files are evidence; they tell the host how the attacker got in and whether a backdoor remains, and deleting them often leaves the actual entry point untouched.
The second is telling everyone. A frightened all-staff email with theories about who did it travels faster than any fix. Sentences that begin "we may have been hacked by" have a way of outliving their accuracy.
The third is rebuilding from scratch at midnight. A tired person reinstalling the same platform, with the same outdated plugin, on the same hosting account, has reinstalled the same hole.
The first hour, in order
First, confirm and document. Take screenshots of everything abnormal. Write down the time you noticed and the time of any alerts. Save every alert email. Note what visitors would have seen and roughly since when. Ten minutes of documentation now answers the questions leadership, customers, and possibly an attorney will ask later.
Next, contain. Put the site into maintenance mode. If it is actively redirecting visitors or serving malware, ask your host to disable it temporarily; that request is routine and reversible. One rule governs this step: protecting the public comes before restoring service. Do not delete anything yet.
Then rotate the critical passwords, from a clean device. Use a computer you trust, not the one that may be compromised, and change passwords in this order: hosting account, content management system (CMS) administrator accounts, registrar, then email. The order matters because each account can reset the ones after it. Turn on two-factor authentication (2FA) anywhere it is missing while you are in the settings.
Then call the host and say the words "my site is compromised." Hosts handle this every day, and that phrase routes you to the right queue. Ask for three things by name: a malware scan of the account, the access logs for the past two weeks, and their read on how the attacker got in.
That is the hour. Everything that follows, restoring and hardening, can happen calmly once these four steps are done.
The rest of the week
Recovery means restoring the newest backup that predates the compromise, then updating the platform, every plugin, and the theme before the site goes public again. Restoring a clean copy of the same vulnerable software simply invites the same visitor back. Rotate any remaining credentials, run the security scans clean, and if Google flagged the site, request a review in Search Console. Watch alerts and traffic closely for two weeks, because reinfection within days is the signature of a missed backdoor.
Finally, write the short incident log entry: what happened, when, how it got in, what was done, and what changed. If customer records, donor information, or form submissions may have been exposed, disclosure duties may apply, and that determination deserves professional advice rather than guesswork.
When to pay someone
Cleanup services such as Sucuri clean compromised sites, typically bundling a firewall and monitoring for a few hundred dollars a year. Pay when any one of three things is true: the site handles commerce or holds personal data; you have no clean backup to restore; or the site was reinfected after your own restore. Otherwise, a tested backup and the sequence above handle the common case. If yesterday's restore test found a problem, today is a good reason to fix it this week.
What to say while it is happening
Inside the organization, tell leadership early and factually: what is confirmed, what is being done, and when the next update comes. Outside, silence is acceptable while facts are gathered; wrong statements are not. A plain holding notice serves visitors best: the site is down for maintenance, service resumes shortly, here is how to reach us in the meantime.
Listen to Episode 9: Security for Non-Security People.
Get the playbook before you need it. The full version of this sequence, formatted as a one-page checklist with blanks for your host's support number, your vault location, and your backup's location, is Playbook 1 of the Web Emergency Playbook. The excerpt is free, just complete the form below and it will be emailed to you. Print it, fill in the blanks today while nothing is wrong, and pin it where a shaken person will find it. The blanks are the last thing you want to be researching during the hour it is for.