Hacked website repair is the work of returning a compromised site to a known clean state and closing the way the attacker got in. Our hacked website repair service covers malware and web shell removal, the entry-point investigation, password and key rotation, a restore tested on a real backup, and the Google review request if your site carries a warning. You get a site you can trust again and a written account of what happened.
What to expect in the first hours
The first hours go to containment and evidence: we copy the current state of the site, limit further damage and only then start removing code. Cleaning first and investigating later usually destroys the traces that show how the attacker entered.
In practice we:
- take a full copy of files, database and server logs before touching anything;
- put the site into maintenance mode or block the malicious paths, whichever keeps your business running;
- change hosting, control panel, database and CMS admin credentials from a clean machine;
- check whether outgoing mail, redirects or payment pages were changed, because those hurt customers first.
How we clean a compromised site
The clean-up compares every file and database entry against a trusted reference and removes what does not belong. A trusted reference is the vendor's original code for the CMS, plugins and themes, plus your own last known clean backup.
| Step | What it means for your site |
|---|---|
| File integrity comparison | Core, plugin and theme files are checked against official copies; modified and extra files are listed |
| Web shell and backdoor search | Hidden admin scripts, scheduled tasks, rogue users and injected code in the database are removed |
| Spam and redirect removal | Injected pages, cloaked links and redirect rules are deleted and the URLs return proper status codes |
| Credential rotation | Every password, API key, salt and SSH key the attacker could have read is replaced |
| Restore test | A clean backup is restored to a separate location to prove it works |
Finding the entry point
The entry point is the specific weakness the attacker used, and the repair is incomplete until it is named. Google's own guidance for hacked sites says the same: fix the security issue that allowed the infection, or the site is likely to be reinfected.
We read web server and authentication logs, review file timestamps, list outdated components and check access rights. The usual answers fall into a few groups, which match categories in the OWASP Top 10:2025: broken access control, security misconfiguration, software supply chain failures in plugins and themes, and authentication failures such as reused passwords. When the logs are missing or too short, we say so in the report and describe what evidence remains.
Google warnings and the review request
A hacked site often shows a "This site may be hacked" label in search results or a browser warning, and both stay until the owner acts. Google removes them after a review requested in the Security Issues report in Search Console.
Google's documentation sets the conditions: the issue has to be fixed on every page, and the request should explain the problem, the steps taken and the outcome. A review of malware or injected content takes from a few days to a few weeks. Sending a request before the site is fully clean slows the next review, so we request it only after our re-check. If the warning is a phishing or "Deceptive site ahead" alert, the process is described on our page about removing the Google deceptive site warning.
When customer data was exposed
If personal data of EU or UK residents may have leaked, the controller has a legal deadline. Under GDPR Article 33, the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to people.
Our part is the facts: what data sat on the server, which records the attacker could reach, and the timeline from the logs. Your data protection lead or lawyer decides whether to notify, and your company files the notification. More on this in GDPR website security requirements.
What you receive
The work ends with a clean site and a document you can show to your management, insurer or auditor.
- A clean, working site and server, with the entry point closed.
- New passwords and keys, handed over through a channel we agree.
- A backup verified by a test restore, with the date and what was restored.
- A report: how the attacker got in, what was affected, what we did, and what to fix next.
- The Search Console review request, if a warning was shown, and its outcome.
What we need from you
To start, we need access and one decision-maker. Specifically: hosting or server access, CMS admin access, Search Console access if you use it, any backups you hold, and a signed scope letter that lists the systems we may touch and the ones we must leave alone.
Boundaries of the service
The service covers cleaning, investigation and hardening. Notifications to a data protection authority, the police or your customers are made by your company. Legal opinions on liability come from your lawyer, and nobody can promise that a site will never be attacked again. If your site runs on a platform where we have no server access, the scope is limited to what the platform exposes, and the scope letter says so.
Risks of a quick fix by yourself, a chatbot or a freelancer
A fast clean-up often removes the visible symptom and leaves the backdoor. Common outcomes of a rushed job: a restored backup that already contained the malware, a deleted log that hid the entry point, or a password changed on a machine that was itself infected.
General advice from a chatbot cannot see your logs, and a freelancer without a written scope usually carries no responsibility for what happens after the job. We work under a contract with a fixed scope, a person checks every finding, and we confirm the fix with a second check.
Who does the work
Security engagements are contracted with INNOVA CONSULT LTD., Ottawa, Ontario (Corporations Canada, Corporation Number 1522612). The same team runs its own servers and more than 80 websites under daily vulnerability checks. The report belongs to you.
Cost
Each repair gets a fixed price in the scope letter after a 30-minute call. The main factors are the number of sites, the depth of the infection and the state of your backups.
Related services
- WordPress security: hardening after the clean-up.
- Website security monitoring: alerts that catch the next change early.
- Website security audit: a full check of everything the attacker did not touch yet.
- DMARC setup and email domain protection if the server sent spam or phishing in your name.
- Back to cybersecurity services or write to us.
Sources (checked 2026-10-23)
- Google Search Console Help, Security Issues report: review conditions and timelines.
- Google Search Help, "This site may be hacked": steps to remove the label.
- OWASP, Top 10:2025: risk categories.
- Regulation (EU) 2016/679, Article 33 GDPR: breach notification to the supervisory authority.
Maksym Stepanenko, founder of Marketing MIX. Last reviewed: 2026-10-23.