A Hacked Website: What to Do Immediately and How to Handle It as a Company

It’s Monday morning, and the owner of an online store selling dietary supplements opens her inbox, which is full of messages from customers. Some write that a suspicious ad for counterfeit watches appeared while they were shopping. Others report that their browser immediately displayed a warning: „This website may harm your computer.“ Weekend sales are zero.

On the surface, the website looks fine—the design is right, the products load, and no one has changed anything. The problem lies deeper: someone gained access and added code that Google and browsers are now blocking en masse.

This exact situation happens to dozens of company websites and online stores in the Czech Republic every week, and very few have a plan in place to deal with it. The most common entry point is usually an outdated plugin, a weak admin password, or a forgotten test account that has remained active for years after it was last used.

We'll go over what to do during the first hour, whether you're legally required to report it to anyone, how to get your website back into Google's search results, and how much such a fix will actually cost you.

How can you tell if a website has been compromised?

It's not always as obvious as a browser warning that a website has been compromised. Attackers often choose a more stealthy approach, because the longer they remain undetected, the longer they can exploit the website.

• Google displays a different title or description in the search results, than the page actually has, typically featuring ads for medications, counterfeit goods, or gambling.
• A new administrator account will appear on the website, which no one on the team created.
• Traffic from Google will drop sharply within a few days, without any action on your part.
• The website redirects some visitors elsewhere, often only on mobile devices or only from certain countries, so you might not even notice it on your office computer.
• Your hosting provider or CDN service will notify you automatically unusually high server load or suspicious outbound traffic.

There's a simple rule: anything on this list is a reason to get it checked out right away—don't wait to see if the problem goes away on its own.

What to Do in the First Class

What to do in the first hour after discovering that a website has been compromised can be summarized in four steps: disconnect, don’t delete anything, back up the data for analysis, and change access permissions. The order is important because a hasty response can cause more damage than the attack itself.

1. Switch the website to maintenance mode, or take it offline temporarily. This will stop the malicious code from spreading to other visitors without losing the data needed to fix the problem.
2. Do not delete or reset anything. You will need the files, database, and logs as evidence for forensic analysis and any subsequent reports.
3. Make a copy of the compromised site separate from the production site. Only on this copy should you look for where the intruder broke in.
4. Change all passwords and access keys, administration, FTP, the database, hosting, and API keys for connected services. An attacker could gain access through exactly these channels, so the attack would simply repeat the old password.

Only after taking these four steps does it make sense to call in a malware removal expert—whether that’s your current web administrator, hosting provider, or a specialized agency.

A quick check to determine exactly when the problem began can also help you figure things out. Look at the list of files last modified on the server and compare the date with the time when someone first noticed the problem. Look for files that were modified in the days leading up to the report, it usually involves just a few specific files, not the entire website, and this clue is the quickest way to determine which path the attacker took.

What You Definitely Shouldn't Do

Knowing what not to do is just as important as knowing what to do. There are three mistakes that are made most often, and each one delays the time it takes for the website to return to normal.

• Don't delete the entire website and don't start building it from scratch. Without knowing the cause, the compromised code will often reappear even in a new installation if the same security vulnerability remains unpatched.
• Do not send new passwords via email or chat, until you know for certain that the attacker does not have access to the mailbox or the communication history.
• Don't underestimate a minor finding. A single suspicious ad or a single unknown file is often just the tip of the iceberg of a larger attack.
• Do not post details about the attack on social media, until you have a clear understanding of the extent of the damage. A premature public admission without the facts can do more damage to your reputation than the incident itself.

Are you legally required to report this to someone?

You have a legal obligation to report a cyberattack on your website if customers’ personal data—such as names, email addresses, physical addresses, or order history—was leaked or could have been leaked during the attack. Under the GDPR, the data controller must report the security breach to the Office for Personal Data Protection (ÚOOÚ) within 72 hours from the moment they become aware of it, if there is a risk to the rights of the people concerned.

If you miss the 72-hour deadline, the law does not automatically impose a penalty, but it does require you to justify the delay (Article 33 of the GDPR). It is better to report the incident early with incomplete information and fill in the details later than to wait for a complete overview of the damages.

If no personal data was compromised—for example, if the incident merely involved a redirect to a fraudulent online store without access to the customer database—the reporting requirement does not apply to you. In cases of uncertainty, it is safer to contact the Office for Personal Data Protection (ÚOOÚ) and let them assess the situation than to risk a fine for a late or missing report.

Fines for GDPR violations range from hundreds of thousands to millions of crowns and depend mainly on whether you intentionally ignored the obligation or were simply late for an excusable reason. A report submitted correctly and on time—even if incomplete—serves as evidence that you addressed the issue responsibly, and in practice, this is often crucial to how the authority ultimately assesses the matter.

What to Tell Customers

What to tell customers depends on whether the attack compromised their data or merely temporarily affected the website’s appearance and availability. However, remaining silent is not a safe option in either case; customers will notice suspicious behavior anyway, whether from an ad, slow loading times, or a browser warning.

A brief, factual message on your website and in an email works better than an apologetic silence: explain what happened, what you’re doing to fix it, and whether customers should check their passwords or payments. If payment information has been compromised, notify customers immediately and advise them to contact their bank. Even though it may sound unpleasant, silence damages trust more than admitting a mistake.

A proven report structure consists of three parts: what happened (in one sentence, without technical jargon), what you’ve already done to resolve the issue, and what the customer should do next—for example, change their password or check their account statement. A message longer than five sentences comes across as an apology rather than information for taking action.

How a Website Gets Back into Google

How a website gets back into Google’s search results is one of the most common questions after a security breach has been resolved—and yet it’s a topic that most technical guides overlook. Google usually flags a compromised website with a security warning directly in the search results or in the browser, causing traffic to drop sharply—similar to what happens with a penalty, which we discussed in our article on Google Spam Update from August 2026.

The return process consists of three steps:

1. Check the "Security" and "Manual Actions" sections in Search Console. Google will describe in detail exactly what type of attack it detected and which pages are affected.
2. After removing the malicious code, submit a request for a review. Google will crawl the site again and remove the warning if it doesn't find anything problematic.
3. Please expect a wait. The inspection itself usually takes several days to two weeks, and it may take several more weeks to return to the original search rankings, depending on how long the warning was displayed.

The speed of recovery depends most on how quickly you submit your request after discovering the attack, and whether the website has a verifiably clean history prior to the attack. That's why it pays to have Regular website backups set in advance, not only when needed.

Browser warnings and a drop in search rankings are technically two different things, even though they are related. Security warnings are based on the Google Safe Browsing system, which any visitor can verify for free directly in the tool Google Transparency Report, by entering the website address. A drop in search rankings is handled separately by Google’s search quality team, so both issues must be addressed individually; removing the warning will not automatically restore lost rankings.

How much does it actually cost?

The actual cost can only be estimated within a range, because the price depends on the extent of the infection, the size of the website, and whether you have a verifiably clean backup. The following figures represent an approximate market range verified from the public price lists of web agencies and security specialists; they are not the rates of any specific company.

The final price is usually influenced by whether the website runs on a widely used content management system like WordPress—where fixes are faster thanks to known attack patterns—or on a less common custom solution, where a specialist must first understand the website’s structure.

Furthermore, none of the prices listed include ongoing protection—that is, monitoring, regular backups, and updates—which would prevent a similar attack in the future. According to the experience of web security agencies, companies that invest only in repairs after an initial attack and do not address security further often find themselves in a similar situation again within one to two years.

If you only have the agency perform a one-time cleanup without follow-up maintenance, expect to receive a similar invoice again in a year or two. Therefore, when comparing quotes, always look not only at the price for a one-time service but also whether the offer includes follow-up monitoring and updates, because that’s the difference between a fix and true prevention.

Our Approach: Self-Help or an Agency?

Doing it yourself makes sense if you have someone in your company who’s technically savvy and the attack is limited—for example, a single redirect script on an otherwise clean website. It’s worth hiring a security agency or specialist when you’re dealing with an e-commerce site that handles customer data, when you’re unsure of the extent of the damage, or when you’re running out of time due to reporting requirements.

One simple question will make the decision easier: if you had to defend an error in a report or correction to a customer, a bank, or a government agency, you’d be better off consulting an expert. The cost of a few hours of consultation is usually negligible compared to the cost of a correction done incorrectly that needs to be redone.

Our practice: For one client—a small e-shop selling gardening equipment—we first reviewed the server logs after the attack and discovered that the attacker had exploited an outdated version of a plugin that the client had installed themselves a year ago and then forgotten to update. The fix itself took a day, but we spent most of our time verifying that the attacker hadn’t gained access to the order database, as this determined whether there was a reporting obligation to the Office for Personal Data Protection (ÚOOÚ). There was no such obligation; however, without this verification, the client would have risked a fine for failure to report.

How to Prevent a Similar Situation Next Time

The best way to prevent a similar situation from happening next time can be summed up in three habits that will stop most attacks before they even become a problem.

• Regular website backup outside the server itself, ideally automated and with a history going back at least 30 days.
• Current SSL certificate and regular updates to the content management system, plugins, and templates, since most attacks target known vulnerabilities in older versions.
• High quality web hosting with its own firewall and monitoring of suspicious traffic—not the cheapest plan with no protection whatsoever.
• Two-factor authentication and a limited number of login attempts to the admin panel, and ideally, restricting access to specific IP addresses if only a few people from the company access the content management system.

If you're in the process of moving your website to another provider or planning a major technical overhaul, this is a good opportunity to review your security from the ground up, as described in our article on Website migration without losing search engine rankings. And if you hire an agency or a developer to maintain your website, it's worth making sure that security and backups are handled directly in contract for website development or management, not just a verbal agreement.

Frequently Asked Questions About a Compromised Website

A compromised website doesn’t mean the end of your business; it’s a technical issue with a clear course of action: disconnect, don’t delete, back up, review your legal obligations, notify customers, and ask Google to investigate. According to him, the sooner you start taking these steps, the sooner you’ll return to your original rankings and revenue levels.

If you're not sure how to determine the extent of the infection on your website, or if you need help with fixing it and reporting it, Please contact us at Apadore. We deal with similar situations on a regular basis and can offer advice even in a crisis.