After Your Site Gets Hacked: Detect, Clean, Harden, and Get Reindexed

Bottom line first: The key to handling a hack is the order, not the speed: in the first hour, do three things — snapshot the evidence, change every password, and scope the infection. Then clean in three layers: files, database, backdoors. When restoring from backup, the restore point must predate the infection. Only after cleanup do you submit a security review request to Google. A typical timeline: cleanup 1–3 days, reindexing 1–4 weeks, rankings 1–2 months.

1. The First Question After a Hack: How Did You Find Out?

First, the boundaries:Security Baseline covers how to set up your defenses in advance,Indexing Diagnostics covers routine troubleshooting for indexing problems. This post is only about what to do after the fact — the full process and timeline from the moment you spot something wrong to getting reindexed and finishing your post-mortem. No matter how well you set up your defenses, they only lower the odds; they don’t mean you won’t get hacked. So every business with a website needs to know this process.

There are usually four signals. Most B2B sites are alerted by the first two.

Detection Signals	What It Looks Like	Common Detection Channels
Spam pages show up in search results	Searching your brand name returns gambling, pharma, or counterfeit results	You search your own brand terms, or a customer tells you
Search Console security alert	You get a “hacked content detected” notice	Search Console email and in-panel messages
Customers report redirects	Visitors coming from search engines get redirected to unfamiliar pages	Complaints from sales and long-time customers
Traffic and log anomalies	Traffic spikes late at night, unfamiliar crawlers, unfamiliar logins to the admin panel	Hosting panel and access logs

Here’s a fact most people underestimate: by the time the boss stumbles on a spam page themselves, the injected content has usually been indexed for weeks. Business sites get few daily visitors, so redirect hijacks are often crawled and indexed by search engines first and only seen by chance later. So rather than saying “detect it early,” the more practical move is to search your own brand terms once a month and check the results — a step you can fold into your Monthly Maintenance checklist. It costs one minute.

2. The First Hour: Three Things to Do — Evidence First, Then Cleanup

In the first hour after you discover a hack, you don’t clean. You do three preparatory things. The order can’t be reversed.

Action	Specific approach	Purpose
Snapshot the evidence	Package and preserve the full site files and database, and record the server’s current time	Preserve evidence of the intrusion so cleanup doesn’t destroy the trail
Change every password	Change all passwords to new ones: hosting, database, admin panel, FTP, SSH, domain, and email accounts	Cut off every entry point the attacker still has
Determine the scope of infection	Confirm whether it’s a single site or multiple sites on the same host, and whether email and domain accounts are affected	Decide how big the cleanup needs to be and whether to notify anyone involved

Why investigate before you clean? Two reasons. First, the evidence of how they got in — which files were changed, when, and from which account — disappears the moment you delete files and overwrite directories, and after that you’re just guessing at how it happened. Second, touching files directly can tip off backdoor scripts; some backdoors trigger data destruction or spread the infection to other sites on the same host when they detect they’re being removed. Save the forensic package somewhere off the server — locally or in cloud storage — never on the infected machine.

Change every password at once. Miss one entry point and the cleanup was for nothing. The usual misses are FTP and database accounts — most people only change the admin panel password. When you’re working out the scope, watch for multiple sites on the same host: one server running the main site, a staging site, an old site. Attackers usually come in through the weakest one, and if you only clean the main site and leave the others, they’ll be back in a few days.

3. Clean on three layers: files, database, backdoors

Work through the cleanup in three layers, each with its own targets and methods.

Tier	What to check	How to do it
File layer	Core program files and recently modified files	Compare core files against the official install package, and sort by modification time to find recent changes
Database layer	Injected scripts and suspicious accounts	Search post content for script tags and review the admin account list
Backdoor layer	Webshells and unusual scheduled tasks	Scan executable files for modification times and code signatures, and check cron jobs

Backdoors hide in predictable places:

Hiding spot	What to look for	What to do
Uploads directory	A .php file in a directory that should only hold images and documents	Delete it and lock down execute permissions on the directory
Theme and plugin directories	A long string of code appended to the end of a core file	Compare against the official package and replace
Site root directory	A randomly named php file whose modification time matches the intrusion window	Delete once confirmed
Cache and config files	Content containing long base64 strings and eval structures	After cleanup, search the whole site for the same signatures

Of the three layers, the backdoor layer is the easiest to miss. Delete only the spam pages and injected content and leave one backdoor file behind, and the pages grow back within days — this is the most common reason a cleanup “comes back,” and the real reason many people believe an infection “can’t be cleaned.” The basic move is to sort the whole site by modification time and go through every file that matches the intrusion window one by one; for anything you’re unsure about, compare it against the official package. One more rule for this layer: after you finish, scan again to confirm nothing is left on any of the three layers before moving on.

4. Restoring from backup: when it works and what to watch for

If your backup system is solid, restoring is usually faster than cleaning layer by layer. But restoration has three prerequisites, and missing any one of them makes it impossible.

Condition	How it’s judged	What to do when a condition isn’t met
The restore point predates the infection	Determine the infection window from logs and file modification times	You have no choice but to clean manually, layer by layer
The backup is complete and usable	Verify integrity on the spot, ideally after a drill	Hybrid approach: restore the files, clean the database manually
Harden immediately after restoring	Upgrade components, change passwords, and patch vulnerabilities all in one pass	Otherwise, a second compromise is only a matter of time

The biggest trap is a restore point later than the infection time: restoring your site from a backup that already contains a backdoor is the same as inviting the attacker back in. Clues for pinpointing the infection time include the modification times of suspicious files, the first backend login from an unfamiliar IP in your access logs, and when spam pages were first indexed — this is exactly where the evidence you gathered in the second hour pays off. Another common mistake is not changing passwords after restoring: passwords stored in plaintext or with weak hashing in the database are far from rare, and the old passwords in the attacker’s hands may still work.

5. The five hardening steps and reviewing the intrusion path

After cleaning or restoring, you must complete five hardening steps, or another compromise is highly likely.

Hardening step	Specific approach	Priority
Update all components	Upgrade the core, themes, and plugins to the latest versions	Highest
Change default paths and accounts	Change the default admin URL, and delete or rename the default administrator account	High
Keep security plugins to a minimum	Install one primary security plugin and enable file change monitoring	High
Restrict backend logins	Login rate limiting, two-factor authentication, and region-based restrictions if needed	Medium
Tighten file permissions	Set config files and upload directories according to the principle of least privilege	Medium

Answer four questions in your review and save it as a one-page document: where did the intrusion come from (an outdated plugin, a weak password hit by credential stuffing, another site on the same host being compromised); why wasn’t it detected earlier (which monitoring was missing); how long did it take from discovery to completed cleanup; and did backups and drills help in this incident. The value of this document lies in next time — most sites are compromised more than once in their lifetime, and the same entry point being breached a second time is a management problem. Fill whatever gaps exist in monitoring and alerts, and align those gaps with the checklist items in your monthly maintenance.

6. Appealing to Google and getting spam pages under control

There is only one rule of timing for appeals: submit after cleanup is complete. Submitting midway drags out the process — if Google finds malicious content again during review, the wait resets, which is far slower than waiting a few extra days before submitting.

Steps	Action	Description
1. Confirm cleanup is complete	All three layers cleaned and a rescan shows no remnants	Check each example URL in Search Console one by one
2. Fix the site itself	Remove malicious content and patch vulnerabilities	Google requires that the site no longer pose a security risk at the time of review
3. Submit for review	Submit it in the Security Issues section of Search Console	Include a description of the steps taken and a timeline
4 Wait for review	The review usually takes a few days to two weeks	Don’t submit repeatedly while you wait

If the injected spam pages have already been indexed, how you handle them matters: returning 410 (Gone) works better than 404 for getting them dropped—Google removes 410s noticeably faster. At the same time, use the Search Console Removals tool to request urgent hiding of the most important spam results. After that, check progress once a week: use the site: operator and brand-name searches to track how many are left. Going from hundreds of indexed pages down to single digits usually takes two to four weeks, and during that time don’t keep resubmitting for review just because progress feels slow.

7. Damage assessment: what comes back and what doesn’t

Before you hand the timeline to your boss, spell out the typical duration and pass/fail criteria for each stage, so you don’t get asked over and over why it hasn’t recovered yet.

Stage	Typical cycle	Passing standard
Cleanup and hardening	1–3 days	Rescan shows no malicious files or leftover scripts
Reindexing and removal of the security flag	1–4 weeks	The security notice disappears and spam search results are mostly cleared
Rankings recover	1–2 months	Core keywords return to roughly their pre-incident positions

Whether the damage is reversible depends on the situation. Sites that only had spam content injected and never received a manual action notice usually regain their rankings after cleanup. Sites explicitly flagged for “spammy behavior” (for example, hidden text and redirects that were injected and then caught and penalized by the algorithm) take longer to recover, and some keywords may never return to their original positions. There’s also a kind of damage that can’t be undone: if customers clicked through to spam pages from email or search while the site was hacked, that lost trust won’t come back just because your pages are indexed again. This is why the first section stresses spotting the signals—every week you delay detection, the contamination spreads further and you lose more customers.

FAQ

How do you find out your site has been hacked?

Watch for four signals: spam pages showing up in brand-name search results, a security notice in Search Console, customers reporting they were redirected, and unusual traffic or unfamiliar logins in your logs. Most business sites find out through the first two. Make “search your brand name once a month and check the results” part of your routine—it costs a minute and can cut detection time from weeks to under a month. The sooner you find it, the lower your cleanup costs and the less trust you lose.

What should you do first if you’ve been hacked?

In the first hour, do three things, in this order: first, make a full forensic backup of your files and database; then change every password at once—hosting, database, admin panel, FTP, domain, email; finally, determine whether the infection is limited to one site or spans multiple sites on the same host. Note: don’t start deleting files in the first hour—cleaning up before collecting evidence destroys the trail of how they got in and may even trigger a backdoor’s destructive routine. Once those three things are done, move on to layer-by-layer cleanup or restoring from backup.

Can I clean it up myself, or do I have to hire a professional?

It comes down to two things: how far the infection spread, and what your team can handle. If it’s a single site, only spam content was injected, and someone on your team knows their way around a server, you can work through all three layers yourself — files, database, backdoors — and finish in a day or two. If multiple sites on the same host are down, your data has been encrypted for ransom, or nobody on the team can read a log, hire a professional. Don’t learn as you delete — an incomplete cleanup leads to repeat infections, and that usually costs more than the service fee. In between, you can clean it yourself and have an outside party rescan.

Will being hacked affect my rankings, and for how long?

It happens in stages: cleanup and hardening usually take 1–3 days, reindexing and removal of the security warning take 1–4 weeks, and ranking recovery takes 1–2 months. If your site only had spam content injected and you never received a manual action notice, rankings generally return to where they were. If you were flagged for spammy behavior, recovery is slower and some keywords never come back. Some damage is irreversible: customer trust lost while you were hacked doesn’t come back with your indexing, so the earlier you catch it, the less you lose.

How long does a Google reconsideration request take to go through?

Approval usually takes anywhere from a few days to two weeks, and it depends on two things: whether the site has been cleaned up completely, and when you submit. Submitting halfway through is the most common mistake — if the reviewer finds malicious content again, the clock resets and you end up waiting longer. The right approach: finish all three layers of cleanup plus a rescan, verify every sample URL one by one, then submit once with a description of what you did, and wait patiently. Don’t submit repeatedly.

How do I find the point of entry?

Cross-reference three clues: the modification times of suspicious files, which narrows down the time window of the intrusion; the first unfamiliar IP logging into your admin panel or SSH in your access logs; and the creation time of suspicious new accounts in your database. Whatever happened around the point where all three line up — which plugin had a known vulnerability at the time, which password had just been credential-stuffed — is almost certainly the entry point. Write your findings into a post-mortem document and close the gap on the spot, or they’ll come in through the same door next time.

Final thoughts

Handling a hack isn’t about how skilled you are — it’s about whether you do things in the right order and whether your checklist is complete: in the first hour, preserve evidence before you clean; work through all three layers — files, database, backdoors; make sure your restore point predates the infection; and wait until cleanup is done before submitting for review. Every step has a clear action and timing. Nothing is left to improvisation.

Three things to put into practice: add “search for your brand terms every month” to your routine checks, save the three-layer cleanup steps from this article as an internal document, and keep a timed record of your recovery drills — what you have on hand on the night of an incident depends on what you prepared in advance. If your team doesn’t have anyone technical, or you’d like this monitoring and backup process set up around your site’s current state, you can Contact Us.One rule is all you need to remember: getting hacked isn’t the scary part. Getting hacked with no plan in place is.