Your site’s been hacked: here’s exactly what to do next

A compromised website creates urgency, but the fastest route to recovery starts with containment and good evidence.

Start with a clear baseline.

Before buying another tool, document what you run and who has access. A short, accurate inventory makes security decisions easier.

Focus on the gaps attackers can use.

Incident response works best when ownership is clear and checks happen on schedule. Keep a record of what you find and assign every fix to a specific person.

• Confirm the systems and accounts in scope.
• Remove access and software you no longer need.
• Patch important weaknesses and verify the change.
• Keep evidence your team can understand and reuse.

Simple controls applied consistently prevent more incidents than a long list of tools nobody owns.

Turn the findings into action.

Set a review date and test the plan. If an area is difficult to verify internally, ask for an independent assessment.