Your site’s been hacked — here’s exactly what to do next

A compromised website creates urgency, but the fastest route to recovery starts with containment and good evidence.

Start with a clear baseline.

Before buying another tool, document what you run, who can access it, and which information matters most. A short, accurate inventory makes every security decision easier.

Focus on the gaps attackers can use.

Incident response works best when ownership is clear and the checks happen on a predictable schedule. Record what you find, prioritise the highest-impact issues, and assign every action to a named person.

• Confirm the systems and accounts in scope.
• Remove access, software, and integrations you no longer need.
• Patch important weaknesses and verify the change.
• Keep evidence your team can understand and reuse.

Simple controls applied consistently prevent more incidents than a long list of tools nobody owns.

Turn the findings into action.

Set a review date and test the plan with the people who will use it. If an area is difficult to verify internally, ask for an independent assessment before the uncertainty becomes an incident.