You open your website and find a page selling something you have never heard of. Or a customer emails to say Chrome showed them a red warning screen. Or Google lists your homepage with the line "This site may be hacked" underneath. It feels like a break-in, and in a sense it is.
This guide walks through what to do, in order, if you run a UK small business and your website has been compromised. It covers the first hour, the legal side under UK GDPR, the clean-up, getting Google to lift its warning, and stopping a repeat.
What should you do in the first hour after your website is hacked?
The order matters. Passwords first, because if the attacker still has your hosting or admin login, anything you fix they can undo. Change these, from a device you trust:
- Your hosting account (the company you pay for the server, such as a cPanel or managed WordPress login).
- Your domain registrar, so nobody can point your domain elsewhere.
- Your website admin login, plus every other admin user. Delete any admin account you do not recognise.
- The email inbox that all of the above reset to. If that inbox is compromised, the attacker can reset everything again.
The NCSC's guidance on recovering a hacked account adds two steps people skip: check your email for forwarding rules, which criminals set up to quietly receive copies of your mail, and log out of all devices and apps on each account. It also recommends turning on two-step verification, also known as two-factor authentication or 2FA.
Then take a backup of the site exactly as it is. It feels odd to back up something broken, but that copy shows a developer how the attacker got in, and you will want it if you later need to show the ICO or your insurer what happened.
How can you tell what kind of hack it is?
A quick way to check for spam injection is to search Google for site:yourdomain.co.uk and scroll. Pages with titles in Japanese, or about pharmacy products and casino bonuses, are a classic sign. Redirect hacks are sneakier, because they often only trigger for visitors arriving from Google on a phone, so the owner typing the address directly sees nothing wrong. Ask someone to search for your business on their mobile and click through.
If you take card payments on the site, or have a checkout or login area, assume the worst until proven otherwise. A skimming script on a checkout page is a far more serious incident than a spammy page in a forgotten folder.
Should you take your website offline while you fix it?
The trade-off is real. A holding page costs you enquiries for a few days. A live site that infects customers' phones or skims card details costs you their trust, and possibly a regulatory problem. Most hosts can switch a site to maintenance mode quickly, and a plain page with your phone number and email keeps customers able to reach you.
Who should you contact first: your host, your developer or the police?
Good hosts will often scan the account, point you at the infected files and tell you whether other sites on the same account are affected. Some will restore a clean backup for you. Ask them directly how far back their backups go, because hacks often sit unnoticed for weeks.
If you lost money, the NCSC tells people to contact their bank through official channels and report it to Report Fraud, which it describes as the UK's reporting centre for cyber crime. In Scotland, the same guidance says to contact the police on 101. If you have cyber insurance, ring the claims line early. Many policies include an incident response helpline and expect to be told before you pay anyone else.
Do you have to report a website hack to the ICO?
The ICO's personal data breach guidance is clear that the 72-hour timeframe is a legal requirement where the threshold is met. The clock runs from when you become aware of the breach, not from when the attacker first got in.
Think about what your site actually stores. A brochure site with no forms may hold no personal data. A contact form that saves enquiries to the database, a booking system, a members area or an online shop almost certainly does. If you are unsure what your site and its plugins collect, our data protection checklist for UK small businesses is a useful way to map it.
How do you clean a hacked website properly?
WordPress is a very common choice for UK small business sites. If yours runs on it, a sensible order is:
- Restore a clean backup if you have one that predates the hack, then update everything immediately.
- If not, reinstall WordPress core files from wordpress.org, and reinstall each plugin and theme from its official source rather than trusting the files on the server.
- Delete any plugin or theme you do not use. Abandoned plugins are a common way in.
- Look in the uploads folder for PHP files. Images do not need code next to them.
- Check the database for unfamiliar admin users and injected scripts in posts and widgets.
- Change all passwords a second time once the site is clean, including database and FTP or SFTP credentials.
The step people miss is finding the entry point. If the attacker got in through an outdated plugin and you restore a backup containing that same plugin, you have rebuilt the door they used. A good developer will check server logs and file modification dates to identify the route, not just remove the symptoms.
How do you get Google to remove the "This site may be hacked" warning?
Google's Security Issues report help page says a review can take from a few days to a few weeks to complete, and warns against submitting another request while one is pending. Asking for a review before the site is genuinely clean can slow down the next request or get the site marked as a repeat offender, so it pays to be thorough first.
Write the review request like a short incident report. An example: "Spam pages were injected into /wp-content/ via an outdated plugin. We removed the plugin, replaced core files, deleted the injected pages and reset all credentials. A site: search no longer returns spam results." Specific beats vague.
Spam pages can linger in search results for a while after you delete them. Make sure they return a 404 or 410 status rather than redirecting to your homepage, so Google drops them cleanly.
What should you tell customers after a website hack?
Not every hack needs a customer email. If attackers only added hidden spam pages and no data was touched, a note to anyone who reported the problem is enough. If personal data was exposed and there is a high risk to people, UK GDPR requires you to tell them directly and without undue delay. The NCSC also suggests telling your contacts when an account has been hacked, so they treat recent messages from it with suspicion. That matters if attackers used your email to send fake invoices.
Keep the message short: what happened, when, what was affected, what you have fixed, what they should do, and a named person to contact. Expect some replies, and handle them the same way you would any complaint. Our guide to handling customer complaints in a UK small business covers keeping responses consistent when several arrive at once.
How do you stop your website being hacked again?
The government's Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses reported a breach or attack in the previous 12 months, including 42% of micro businesses and 46% of small businesses. Phishing was the most common type, reported by 38% of businesses. For a website, that often means a fake "your hosting is suspended" email that harvests the admin password.
Practical habits that close most of the common gaps:
- Turn on automatic updates for minor releases, and check major updates monthly.
- Give each person their own login with only the access they need. No shared "admin" account.
- Store backups somewhere other than the same server, and test a restore at least once.
- Set up Search Console email alerts so Google tells you about problems before customers do.
When is it better to rebuild than to repair?
Repair is the right call for a well-maintained site with a recent clean backup and a known entry point. Rebuild is the honest answer for an ageing site held together by plugins whose developers stopped updating them years ago. If you rebuild, keep the URLs that already rank, set up redirects for any that change, and resubmit your sitemap so you do not lose the search visibility you had before the hack.
Website Hacked? What UK Small Businesses Do Next — FAQ
My website has been hacked. What do I do first?
Change the passwords that control the site before anything else. That means your hosting account, your domain registrar, your website admin login and the email account all of those reset to. Turn on two-step verification wherever it is offered. Then take a full backup of the site as it is now, hacked files included, so you or a developer can work out how the attacker got in. Contact your web host's support team next, because they can see server logs you cannot. Write down the time you noticed the problem and each step you take. If customer data might be involved, that record matters for the ICO's 72-hour reporting window. Leave deleting files and reinstalling until you have a backup and a plan.
Do I need to report a hacked website to the ICO?
Only if personal data was affected and the breach is likely to put people's rights and freedoms at risk. The ICO says that if a risk is likely, you must notify it as soon as possible and, where feasible, within 72 hours of becoming aware of the breach. A brochure site with no forms or customer accounts may hold no personal data at all. A shop, booking system or contact form that stores enquiries almost certainly does. If you decide the breach does not need reporting, keep a written record of what happened and why you made that call, because the ICO expects you to be able to justify it.
How long does it take Google to remove a hacked site warning?
Google's Search Console help pages say a review can take anywhere from a few days to a few weeks once you request one through the Security Issues report. The clock only starts when you submit the request, and you should only submit it once every affected page is clean. Google warns that requesting a review before the problem is fixed can slow down your next request or get the site treated as a repeat offender. If your site is not yet verified in Search Console, verify it first. Without that you cannot see the report or ask for a review.
How common are cyber attacks on UK small businesses?
Common enough that a hacked site should be treated as a routine business risk rather than bad luck. The government's Cyber Security Breaches Survey 2025/2026, with fieldwork carried out between August and December 2025, found that 43% of UK businesses reported a breach or attack in the previous 12 months. The figure was 42% for micro businesses and 46% for small businesses. Phishing was the most common type, reported by 38% of businesses. Many website hacks start with exactly that: a stolen password from a convincing fake login email.
Should I repair a hacked website or rebuild it?
Repair makes sense when you have a clean backup from before the hack, you know how the attacker got in, and the site runs on maintained software. Rebuild makes more sense when the site is several years old, depends on abandoned plugins or themes, has been hacked before, or nobody can say with confidence which files are original. A half-cleaned site often gets reinfected within weeks because a hidden backdoor was missed. If you do rebuild, treat it as a chance to drop the plugins and features you no longer use, since every extra component is another thing that needs patching.
