Hacked Website Repair UK

Signs your website has been hacked

Many hacks are designed to be invisible to the site owner. Attackers often show spam or redirects only to search engines or mobile visitors, and hide from logged-in administrators. Common signs:

• Search Google for site:yourdomain.co.uk and see pages you never created.
• Google Search Console reports a security issue or manual action.
• Your host sends a malware or outbound spam warning.
• New admin users, changed admin email addresses, or new files with random names in the uploads folder.
• The site suddenly slows down or uses far more server resources than normal.

Hacks are common. The UK Government's Cyber Security Breaches Survey 2025 found 43% of UK businesses reported a breach or attack in the previous 12 months.

How we repair a hacked site

1. Contain: put the site into maintenance mode or block public access if it is harming visitors, and take a forensic copy of the hacked state.
2. Find the entry point: server access logs, recently modified files, outdated plugins or extensions with known vulnerabilities, weak or reused passwords, or a compromised hosting account.
3. Clean files: replace CMS core with clean copies from the official source, reinstall plugins and themes from trusted sources, and hunt backdoors such as obfuscated PHP using eval, base64_decode or gzinflate, and PHP files hidden in upload folders.
4. Clean the database: injected scripts in posts, options and widgets, spam pages, rogue admin users, and malicious cron entries.
5. Close the hole: update or remove the vulnerable component.
6. Reset credentials: CMS admin, database, SFTP, hosting control panel and API keys, plus WordPress salts or equivalent secrets.
7. Request reviews: submit a review in Google Search Console and check other blocklists.

Full detail on the cleaning process is on our malware removal page.

Restore from backup or clean in place?

If you have a clean backup from before the hack and the content has not changed much since, restoring it is often quickest. But a backup only helps if you also close the hole; otherwise the site is reinfected within days. And many hacks sit unnoticed for weeks, so recent backups may already contain the malware.

We compare backups against the hacked site to choose the cleanest starting point, then patch before going live. Every dijitul plan includes daily backups stored off the server. See website backups.

Shops, customer data and your legal duties

If your site handles customer data or payments, a hack may be a personal data breach under UK GDPR. The ICO expects reportable breaches to be reported within 72 hours of you becoming aware. We help you work out what data the site held and what the attacker could reach, so you can make that decision with the facts. See GDPR IT compliance.

On WooCommerce, Magento, PrestaShop and OpenCart, we check checkout pages and settings for card skimming scripts, which often hide in the database rather than files. Also tell your payment provider if you suspect card data was exposed.

Hardening after the clean-up

Cleaning a site without hardening it is like changing the locks but leaving a window open. After every repair we:

• Remove unused plugins, extensions, themes and old copies of the site left in subfolders.
• Turn on two-factor authentication for every admin account and remove shared logins.
• Set correct file permissions and disable PHP execution in upload folders.
• Disable in-dashboard file editing where the platform allows it.
• Make sure the site runs a supported PHP version.
• Set up off-server daily backups and monitoring so a repeat is spotted quickly.

Prices and keeping it clean

Hacked site repair is charged at £45 an hour + VAT (30-minute minimum, then 15-minute blocks). Heavily infected or very large sites are quoted after an initial assessment. Afterwards, a plan from £25 a month + VAT keeps software updated and checked, takes daily backups and monitors uptime and security, which is the best defence against a repeat. See website security and cyber security support. If it is happening now, see emergency website support.

What it costs

Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.

Related