Our Website Got Hacked, What Do We Do? Step by Step Emergency Response

Quick answer: Is your site defaced, spreading spam, redirecting visitors or flagged by Google as harmful? Speed matters, but deleting everything destroys evidence and the root cause, so you get hacked again fast. In short: put the site in maintenance, preserve logs, change all passwords, find and close the flaw, then restore a clean backup. DSET handles cleanup, root cause fix and monitoring with one team. Emergency: +90 536 662 38 09.

First steps, in order

  1. Maintenance mode. Protect visitors and customer data, take it offline rather than deleting.
  2. Preserve evidence. Server logs, changed/added files and the database show how it got in, back them up before cleaning.
  3. Change all passwords. Admin panel, hosting/cPanel, database, FTP/SFTP and email.
  4. Audit users and permissions. Look for hidden admin accounts and backdoors the attacker added.
  5. Do not restore before closing the flaw, the same hole re hacks a clean backup.

The real issue, find and close the flaw

Cleaning alone is not enough, close the entry door or it recurs. Common causes are unpatched plugins/themes, weak admin passwords, an outdated CMS and OWASP Top 10 flaws. So a post breach pentest and web security audit are essential, managed via the IR playbook.

Legal duty, KVKK

If customer data leaked, a 72 hour notice may apply, ignoring it risks heavier penalties.

Prevent recurrence

After cleanup, protect continuously, a WAF, regular updates, strong passwords and MFA, backups and managed security/monitoring.

Why DSET

Since 2003, cleanup, root cause fix and monitoring by one team.

FAQ

What now? Maintenance mode, keep logs, change passwords, call us, we find and close the root cause. Host cleaned it, done? Usually not, hosts clean surface but leave the flaw, an audit is essential. Google harmful warning? After cleanup and fix, request a review in Search Console, it clears when clean.

Emergency website response: +90 536 662 38 09.