Business website hacked: what you need to do right now

How to recognise a hack

A hack isn't always visible. Google points out that hacked content is often invisible to visitors and still causes damage. WordPress.org lists typical signs that also apply to other systems:

• Google, Bing or virus scanners warn about your website
• Your host has blocked the website
• Customers report strange redirects or ads
• There are new user accounts that nobody created
• Your website sends spam or your emails suddenly end up on blocklists
• Unknown pages appear under your domain in Google search

The first hours: limiting the damage

Stay calm and don't act rashly. Both the WKO and WordPress.org recommend this. Hasty deleting destroys traces you'll need later to find the cause and for a possible police report.

First, document what you see: time, screenshots, error messages, recent changes to the website. Then take the website offline. Google advises stopping the web server or pointing the domain to a static page on another server that returns status code 503. An entry in robots.txt isn't enough, because visitors still see the harmful content.

Inform your host immediately. Especially with shared hosting, the attack may affect more than your website, and the host can often provide log files and backups.

Locking and resetting access

Change the passwords for all access: CMS administrators, FTP or SFTP, database, hosting customer area and the email accounts used to reset passwords. Check the user list in the CMS and delete accounts you didn't create and don't recognise. Note their names first for your documentation.

WordPress.org also advises renewing the security keys in wp-config.php. This logs out everyone who is still logged in. Have your own computer checked with a virus scanner too. According to WordPress.org, an attack often starts on the computer you log in from.

Important: change the passwords once more after the clean-up. If malicious code was still on the server, the first new passwords may have been intercepted.

Reporting obligations: Datenschutzbehörde, CERT.at, police

If the attacker had access to personal data, such as contact form enquiries, customer accounts, orders or job applications, there is usually a personal data breach. Under Art. 33 GDPR, you report it to the Datenschutzbehörde (DSB, Data Protection Authority) without undue delay and, where feasible, within 72 hours of becoming aware of it. Exception: the breach is unlikely to result in a risk to the rights and freedoms of the people affected. If you report later than 72 hours, you have to give reasons for the delay.

The Datenschutzbehörde accepts reports via an online form, a PDF form, by email to dsb@dsb.gv.at or by post. The report describes the nature of the breach, the categories of data affected and the approximate number of people affected, the contact details of the contact person, the likely consequences and the measures taken. If the risk is high, under Art. 34 GDPR you must also inform the people affected without undue delay.

CERT.at, Austria's computer emergency response team, accepts reports of security incidents by email to reports@cert.at. According to CERT.at, it is not a general IT helpdesk and does not clean up your website. The WKO also recommends reporting criminal acts to the police and names the reporting office against-cybercrime@bmi.gv.at.

Cleaning up, going back online, informing Google

A clean backup from before the attack is the fastest way back. Restore it, update all software immediately afterwards and close the hole the attacker came in through. Otherwise you'll be hit again before long. Before the clean-up, make a copy of the infected state. WordPress.org recommends this so you can fall back on it if needed.

If Google has flagged your website, you'll see this in the “Security issues” report in Search Console. Once all problems on the whole website are fixed, request a review there. Describe the problem, the measures taken and the result. According to Google, the review takes several days or weeks. Don't submit the request more than once, as that can prolong processing. Also check in Search Console whether unknown users have been added.

If the website is old and poorly documented, a rebuild with fresh access credentials can be cheaper and safer than a long search for traces.

So it doesn't happen again

• Install updates for CMS, plugins and themes on an ongoing basis
• Delete unused plugins, themes and user accounts
• Long, unique passwords and two-factor login for all admin accounts
• Automatic backups, with a copy outside the server, and regular test restores
• Set up Search Console so Google notifies you about security issues
• An emergency plan with phone numbers for your host, IT service provider, WKO hotline and Datenschutzbehörde

Step by step

1. Stay calm and document

   Note the time, what you see and what was last changed. Take screenshots. You'll need these notes for your host, experts, reports and a possible police report.

2. Take the website offline

   Show a maintenance page with status code 503 that doesn't come from the infected server, or have your host stop the website. This protects visitors from malicious code.

3. Inform your host

   Call your host. Ask about log files, available backups and whether other services such as email are affected.

4. Lock all access

   Change the passwords for CMS, FTP or SFTP, database, hosting and email. Delete unknown admin accounts. Check your own computer for malware.

5. Get help

   As a WKO member, you can reach the Cyber Security Hotline on 0800 888 133 around the clock. The initial consultation with an IT security firm is free; you pay for further services yourself.

6. Check the 72-hour deadline

   Clarify whether personal data may be affected. If so, and a risk can't be ruled out, report the breach to the Datenschutzbehörde within 72 hours. Record your decision in writing.

7. Report the incident to CERT.at

   Send a short report to reports@cert.at. In the case of criminal acts, file a report with the police.

8. Clean up and secure

   Restore a clean backup or have the site rebuilt. Update everything, close the hole and then change the passwords a second time.

9. Request a Google review

   If Google has flagged the website, request a review in the “Security issues” report in Search Console once everything is clean.

Common mistakes

• Deleting or overwriting the website immediately. This loses traces that matter for the cause, the report to authorities and a police report.
• Changing only the CMS password. FTP, database, hosting and email then stay open.
• Restoring a backup without closing the hole. The attacker comes back the same way.
• Letting the 72-hour deadline pass because not everything has been clarified yet. If you report later, you have to give reasons for the delay.
• Only blocking the website via robots.txt. Visitors still see the harmful content.
• Sending the review request to Google several times. That can delay processing.

Frequently asked questions