What to Do If Your Website Gets Hacked

There’s no denying it, discovering that the website you’ve poured hours of time and pots of money into has been hacked is alarming and stressful. Recovering is rarely straightforward but usually possible. In this blog, we’ll take a broad look at the prompt and systematic actions that can help minimise damage and restore security.

1. Don't Panic

When you discover a breach, it's important to take a breath.

Time is critical and the longer a hack remains unaddressed, the more damage it can cause to your business reputation and customer trust. However, we’re sloppy when we’re stressed. Therefore, do everything you can to approach the problem from a logical and measured state of mind.

2. Isolate the Problem

If you can’t get into the website management system, you will need to focus your efforts on working with your hosting provider’s support teams. If you’re still able to access it, here are the most important steps to take:

• Take the website offline temporarily or at the very least block transactions and logins

• Put up a maintenance page to inform visitors

• Disconnect the affected server from your network if applicable

• Document everything you observe about the hack for later analysis

3. Notify Relevant People

Communication is crucial during a security incident. The key stakeholders you’ll want to notify include but are not limited to:

• Your IT team or consultant

• Business partners and staff who might be affected

• Your legal team (for compliance requirements)

• Law enforcement if the breach involves sensitive data

• Your client base - more on this soon

4. Assess the Damage

Conduct a thorough investigation to understand:

• What data was compromised

• How the attackers gained access

• What malware or backdoors might have been installed

• Which, if any, systems were affected beyond the website

5. Customer and Data Breach Notification

If customer data was compromised, you may have legal obligations to notify affected individuals and relevant authorities. This process should include:

• Determining which customers are affected

• Understanding your legal reporting requirements (which vary by region)

• Preparing clear, transparent communications about the breach

• Setting up support channels for affected customers. This might be guidance on avoiding phishing scams which they may be more vulnerable to, or offering a subscription to a credit monitoring service.

6. Clean and Restore Your Website

Rather than trying to remove malicious code, security experts often recommend:

• Restoring your website from a clean backup taken before the hack

• Reinstalling your content management system and themes

• Manually reviewing and reinstalling plugins/extensions after vetting them

• Changing all passwords, API keys, and access credentials

7. Close Security Vulnerabilities

Before restoring your site, address the security weaknesses that allowed the hack:

• Update all software, including your CMS, plugins, and server software

• Implement stronger access controls and authentication

• Review and tighten server configurations

• Remove unnecessary plugins, features, or access points

8. Enhance Security Measures

Use this opportunity to strengthen your overall security posture:

• Implement a Web Application Firewall (WAF)

• Set up regular security scans and monitoring

• Enable HTTPS across your entire site

• If available to you, consider engaging with security professionals for a thorough review

• Implement multi-factor authentication for all admin accounts

9. Create a Recovery Plan

Develop a formal incident response plan for future security events:

• Document the recovery process you followed

• Assign clear responsibilities to team members

• Establish communication protocols

• Set up regular backup schedules

• Plan for regular security training for your team

A website hack is not fun, but with proper handling, it can recover and emerge stronger. By following these steps, you'll not only address the immediate security breach but also establish more robust protections for the future. Remember that website security is an ongoing process, not a one-time fix, and requires continuous attention and updates to stay ahead of the threats.

---

Let’s keep learning. Sign up to The Key, a free 5 day course in cybersecurity for small businesses

The new program is designed for those who own and run small businesses, wanting to strengthen their defences but are unsure where to start.

Over the space of one week, the program will guide you to build in solutions to build resilience, professionalise your brand and protect your business and it’s clients.

No matter your tech level, these are the essential, bare minimum kind of defences you need to pay attention to for a successful year ahead.

DISCLAIMER: The information provided on this blog is for general informational purposes only. While we strive to keep the information up to date and accurate, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability of the information contained on this blog. Any reliance you place on such information is strictly at your own risk. We will not be liable for any losses or damages in connection with the use of our blog. This blog may contain links to external websites that are not provided or maintained by us. We do not guarantee the accuracy, relevance, timeliness, or completeness of any information on these external websites. We reserve the right to modify, update, or remove the contents of this blog at any time without notice.

---