In short: If your website has been hacked, the most important question is "what should I do without destroying evidence?" We take over containment remotely, preserve logs and files, remove malicious code, close the entry point and document everything. You keep the decisions, we supply the technical facts.
Website hacked: what to do in the first hour
The first steps decide whether the incident can be cleanly investigated later. Calm matters more than speed at any price. You can do these things yourself right away:
- Delete nothing: do not remove files, do not reinstall over the old state, and do not restore a backup before everything has been preserved.
- Isolate: put the website into maintenance mode or take it offline temporarily if visitors are at risk or data could be leaking.
- Keep logs: ask your hosting provider not to overwrite access and error logs. For PHP2Shell, the trade press advises keeping server logs from 20 October 2026 onwards.
- Note down access: who has admin, FTP, SSH and panel access? Change passwords only after agreeing it, and from a clean device.
- Inform those involved: management, data protection officers and, if you have a policy, your insurer.
Assume that an attacker with access to the web server could also read credentials from configuration files. Database, mail and API access therefore belong on the list of secrets to be changed.
Which signs point to a compromise is described on the page Am I already compromised?.
How does PHP SOS help?
- Situation picture: Together with you we clarify what was observed, which systems may be affected and which data is stored there. From this we produce a short assessment with the next steps.
- Preserve and contain: We back up files, database and logs before anything is changed. Then we contain the attack, for example by blocking suspicious accounts, disabling compromised functions or temporarily isolating the site.
- Find and close the entry point: We check the PHP version and patch level, the CMS, extensions and access. If the entry via PHP2Shell seems likely, we patch and restart all PHP processes.
- Clean up and restore: Webshells, backdoors and manipulated files are removed, or the state is rebuilt from trusted sources. Details are at Having malware and webshells removed.
- Closure and report: You receive documentation of the incident and recommendations for hardening. If court-admissible investigation is needed, we bring in specialised forensic partners.
What you get from us
- a timeline of the incident, as far as the traces can prove it
- a list of the malicious components found and removed
- a description of the probable entry point, clearly separated into proven, probable and unknown
- a list of all access credentials and secrets that were changed
- recommendations on what should be secured permanently
The report helps in conversations with data protection officers, your insurer and, where applicable, the police. For the legal classification, such as the GDPR notification duty within 72 hours, it is no substitute for advice from specialists.
What we need from you
- Access: to the server (SSH or panel), to the CMS backend and to the database, or alternatively permission to speak directly with your hosting provider
- Contact person: someone reachable with authority to decide on shutting down, restarts and password changes
- Information: since when the problem has been noticed, what changes were made recently, who had access
- Backups: where backups are stored and how old they are
- Contact with service providers: the agency, developer or hosting provider who know the system
What we do not promise
We cannot promise that every attack can be fully reconstructed. If logs are missing or have already been overwritten, gaps remain, and we will name them openly. Nor do we promise that a cleaned site will stay secure forever. We work on the incident until it is closed and documented, and we tell you what still needs to be done afterwards.
We do not provide legal advice. Questions about notification duties, liability or insurance cover belong with data protection officers, lawyers and insurers. For a structured approach after the incident, our checklist after a hack helps.
When a larger incident response is needed
Some incidents go beyond a single website: several servers, leaked customer data, extortion, or an attacker moving through the network. In that case we switch to a structured incident response with fixed roles, status meetings and coordinated communication. We discuss the transition with you as soon as it becomes apparent.
Even after a smaller incident, it is worth looking ahead. A cleaned website without hardening, updates and monitoring remains an obvious target, because attackers often check known victims again. It therefore makes sense to decide after closure who will be responsible for updates, backups and checks in future. The incident often reveals a gap exactly there: nobody felt responsible, or the access credentials were held by a service provider who could no longer be reached. We clarify these questions with you in the closing conversation so that the incident leads to better operations.
Frequently asked questions
Should I delete the hacked website immediately and set it up again?
Please do not rush into it. If you delete everything, you destroy the traces that show how the attacker got in and whether data was taken. It is better to take the site offline or isolate it and back it up first.
How do I know that my website has been hacked?
Typical signs are foreign redirects, spam pages in the Google index, unknown admin accounts, new PHP files, or warnings from the browser, the hosting provider or Google. A sharp rise in server load or unusual outgoing traffic can also be indications.
Do I have to report a hacking attack?
If personal data may be affected, a duty to notify the supervisory authority within 72 hours may apply. Please clarify with your data protection officer or a lawyer whether this applies to you.
Does the emergency help also work if the server is at a hosting provider?
Yes. We work with the access you have and coordinate with your hosting provider if needed. What we can check depends on the rights you are able to give us.