How Do You Clean a Hacked Website?

You clean a hacked website in five steps. Take the site offline, change every password it touches, remove the malicious code, close the hole the attacker used, then request a review to clear any security warning. Removing the code is usually fastest by restoring a clean backup from before the break-in. Google's own "Help for hacked sites" series lays out the same path.

The cleanup at a glance

Work the steps in order, because cleaning before you contain just lets the damage keep spreading.

Step, in order	What you do
Contain	Take the site offline and change every password
Assess	Confirm what was hit via Search Console and a malware scan
Clean	Restore a clean backup, or remove the code by hand
Close	Patch the vulnerability that let the attacker in
Recover	Request a Search Console review to lift the warning

First, contain the damage

Contain the site before you try to clean it, so the infection stops spreading while you work. Take the site offline or into maintenance mode, which also stops it serving malware to visitors and digging its search reputation deeper.

Change every password the site touches next: hosting, admin logins, database, and FTP. If customer data may have been exposed, a separate clock starts, because Malaysia's PDPA requires a fast breach report, covered in what to do after a data breach.

Tell your host early. Google's Help for hacked sites series puts building a support team and quarantining the site among its first remediation steps, because a host can often confirm the breach and help isolate it.

Confirm what was hit

Work out what the attacker actually did before you clean, because the fix depends on the damage. Open Google Search Console's Security Issues report to see what Google detected, and check your URL in Google's Safe Browsing status tool.

A malware scan from your host or a security plugin confirms which files changed. Look for admin accounts you did not create, unfamiliar files, and pages of spam links or redirects.

The point is a full picture, not a first guess. A hack that injected spam links is a different job from one that planted a backdoor, and missing the backdoor is how sites get reinfected.

Remove the malicious code

Remove the malicious code, and the fastest clean route is usually to restore a clean backup from before the break-in. Restoring a known-good copy is almost always quicker than picking malware out of a live site by hand.

If you have no clean backup, the cleanup is manual: delete the injected code and any backdoor files, then reinstall core software, plugins, and themes from official sources. Every component has to be current.

In our experience maintaining Malaysian SME websites, the sites that recover quickly are the ones with a recent off-server backup. The ones cleaning by hand take far longer, and a pattern we see is that many owners have no backup until the day they need one.

Close the door that let them in

Find and close the entry point, or the site gets hacked again. Cleanup removes the symptom; the vulnerability is the cause, and reinfection is common when it survives.

Most break-ins use a known hole. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, with 91% in plugins, so an outdated plugin or theme is the usual way in. Pirated software is another, since it can carry a backdoor from the start.

The full list of common entry points sits in why websites get hacked. Close yours by updating everything, removing nulled software, pruning old admin accounts, and enforcing strong passwords.

Request a review and recover

Once the site is genuinely clean and patched, request a review to clear any warning, never before. A review requested while malware is still live fails, slows your next review, and can get the site marked as a repeat offender.

If Google flagged the site, submit the review through the Security Issues report in Search Console. Google says a review can take from a few days to a few weeks to complete.

Getting off a security blacklist has its own steps, covered in how a malware blacklist works. Rankings often return once the warning is lifted, but Google gives no timeline.

Frequently asked questions

Should I clean the site myself or hire someone?

It depends on what was hit and whether you hold a clean backup. A simple spam-link injection with a recent backup is often a restore-and-patch job an owner can manage. A planted backdoor, or no backup at all, is where a professional cleanup pays for itself, because a missed hidden file means reinfection. If any customer data leaked, treat it as urgent and get help fast.

Will I lose my Google rankings after a hack?

Often temporarily, yes. Google can flag or demote a hacked site, and browsers warn visitors away, so traffic drops until you clean it and pass a review. Rankings often return once the warning is lifted, though Google gives no timeline. The bigger risk is reinfection, so closing the entry point matters as much as the cleanup itself.

How do I know the site is fully clean?

You confirm it with a fresh malware scan, a clean Safe Browsing status, and a passed Search Console review, not by eye. A site can look normal to a visitor while still serving hidden spam or holding a backdoor. Scan again after cleaning, check that no unfamiliar admin accounts remain, and only then request a review.

Can restoring a backup alone fix a hacked site?

Not on its own. Restoring a clean backup removes the malicious code, but it also restores the same vulnerability that let the attacker in. Without patching that hole, the site is open to the same attack again. Always pair a restore with updating everything and changing passwords.

How long does the whole cleanup take?

It depends on your backup, plus the review wait. With a clean backup, removing the code and patching is fast. Without one, manual cleanup of a badly infected site runs much longer. The Search Console review then adds a few days to a few weeks on top, which is why prevention costs far less than any cleanup.

Getting clean and staying clean

Storming Solutions builds custom-coded websites for Malaysian businesses from Kuala Lumpur, and maintains existing WordPress sites. The emergencies that reach us almost never start with a clever attacker; they start with a plugin nobody updated. That is why our maintenance is deliberately unexciting: updates, backups, and pruned access.

If your site is showing a warning or behaving strangely, do not wait for it to spread. Message us about web development and maintenance, and we will help you clean it and close the hole that let it in.