Rescue · starts at $997
My Website Has Been Hacked. What Do I Do Right Now?
Someone else is in your website. What to do in the first hour, what not to touch, and how sosSTEVIE gets you clean and back online, starting with the $997 Site Rescue.
If your website has been hacked, do four things in this order: take the site offline or into maintenance mode, change every password from a different device, take a full forensic backup before you clean anything, and stop touching it. Don't delete the spam pages. Don't just reinstall the theme. Those instincts feel productive and they destroy the evidence needed to find how the attacker got in — which is the only thing standing between you and being hacked again next month. sosSTEVIE handles hacked site recovery end to end, starting with the $997 Site Rescue: containment, forensics, clean-up, de-indexing, and closing the entry point. Most small and medium sites are fully recovered within the $997; larger sites are quoted in writing before any further work.
Key takeaways
- Deleting the spam pages is the most common first move and it's the wrong one. It hides the symptom and leaves the door open.
- The damage isn't the spam. It's your domain reputation — and that's what takes months to rebuild, not days.
- If you clean without finding the entry point, you'll be reinfected. Usually within weeks, often within days.
- Removing bad pages isn't enough. They must be properly de-indexed or Google keeps serving them.
- Your backups are probably infected too. The compromise almost certainly predates the day you noticed.
Rescue · the $997 Site Rescue
My Website Has Been Hacked. What Do I Do Right Now?
Don’t delete anything. Call me.
Someone else is in your website. Here’s what to do in the first hour, what not to touch, and how I get you clean and back online. For most small and medium sites, that’s the $997 Site Rescue.
Call (754) 302-4631 during working hours, Monday to Friday, 9 to 6 Eastern. Outside those hours, text Stevie instead and he’ll get back to you first thing.
The direct answer
If your website has been hacked, do four things in this order: take the site offline or into maintenance mode, change every password from a different device, take a full forensic backup before you clean anything, and stop touching it. Don’t delete the spam pages. Don’t just reinstall the theme. Those instincts feel productive and they destroy the evidence needed to find how the attacker got in, which is the only thing standing between you and being hacked again next month. sosSTEVIE handles hacked site recovery end to end, starting with the $997 Site Rescue: containment, forensics, clean-up, de-indexing, and closing the entry point. Most small and medium sites are fully recovered within the $997; larger sites are quoted in writing before any further work.
- Deleting the spam pages is the most common first move and it’s the wrong one. It hides the symptom and leaves the door open.
- The damage isn’t the spam. It’s your domain reputation, and that’s what takes months to rebuild, not days.
- If you clean without finding the entry point, you’ll be reinfected. Usually within weeks, often within days.
- Removing bad pages isn’t enough. They must be properly de-indexed or Google keeps serving them.
- Your backups are probably infected too. The compromise almost certainly predates the day you noticed.
Do not
- Don’t delete the spam pages.
- Don’t just reinstall the theme.
- Don’t run a one-click “fix” plugin.
- Don’t restore a backup blind.
Every one of those feels like progress. Every one destroys the trail. Doing the wrong something is how a one-week recovery turns into three months of reinfection.
The first hour
If it’s happening right now, stop and do this.
Five steps. In order. Nothing gets cleaned yet.
Take the site offline.
Maintenance mode, holding page, or pull it entirely. Every minute it’s live it serves malware to your customers and digs your reputation deeper. It feels drastic. Do it anyway.
Change passwords from a different device.
Hosting, WordPress admin, FTP/SFTP, database, domain registrar, and the email account that can reset all of them. Use a device that hasn’t touched the site. If there’s a keylogger on the machine you built the site from, you’re handing over the new passwords.
Check who else is an admin.
In WordPress: Users → Administrators. Look for accounts you don’t recognize, and look carefully at the ones you do. A good attacker doesn’t add “hacker123”. They escalate a dormant account or create something that looks like a plugin’s service account.
Take a full forensic backup. Now. Before you clean anything.
Files and database, infected exactly as they are. This is the step everyone skips and the one that decides whether this happens again. It’s your only record of what was done and how.
Then stop.
I mean it. Don’t delete pages, don’t reinstall the theme, don’t run a one-click “fix” plugin. I know how badly you want to do something. If it’s live and bleeding, that’s a phone call, not a form.
The story
I didn’t find out from a security alert. I found out because the phone stopped ringing.
For weeks my site looked completely, boringly normal. Homepage fine. Contact form fine. That’s not an accident. That’s the craft. A good compromise is invisible to the owner by design: it shows you your site and shows Google something else.
Underneath, somebody had made themselves primary admin and built tens of thousands of pages I never saw. Casinos. Pharmaceuticals. Mail-order brides. My domain, the one I’d spent years making trustworthy, was laundering someone else’s rankings.
By the time I understood, my domain’s reputation was gone. Not damaged. Gone. I took the entire site down.
In about four minutes you’re going to have to make some decisions. I want you to know they’re being made by someone who’s stood exactly where you’re standing.
What’s actually been taken
The spam isn’t the damage. The spam is the exhaust.
Google spent weeks watching your trusted domain publish thirty thousand pharmacy pages and drew the obvious conclusion. Your rankings didn’t dip. Your trust went. That’s why “just delete the pages” fails: you can remove every spam page in an afternoon and stay invisible for months. An outage ends when the site comes back. This doesn’t.
Source: IBM, Cost of a Data Breach 2025. Enterprise data from organizations with security teams. Treat it as directional, not a number about your website. The direction is the point: the average intruder is inside for the better part of six months before anyone notices, and small businesses aren’t finding out faster than banks. Mine ran for weeks. By that benchmark I got off lightly.
Your customer data
Attackers who can create thirty thousand pages can read your database. Customer records, inquiry history, whatever your contact form has stored since 2019. That’s a disclosure obligation now, and the clock started when the breach did, not when you noticed.
I’m not a lawyer. If customer data was in there, talk to one this week.
Your backups
Everyone’s plan is “restore from backup.” Your backups are almost certainly infected, because the breach predates the day you noticed and your rotation probably doesn’t reach back that far. Restoring blind just reinstalls the attacker.
What this actually costs you
The clean-up is the cheap part.
The $997 needs context. The expensive parts are the revenue you lose while you’re invisible, the months of rebuilding domain trust, the customers who hit a browser warning and quietly went elsewhere, and, if customer data was exposed, notification, legal advice and whatever your jurisdiction requires.
IBM’s same 2025 report found that breaches identified in under 200 days cost dramatically less than those that ran longer, a difference measured in millions at enterprise scale. Scale it down and the shape holds: speed of detection is the single biggest variable you still control.
Caught in days, it’s a bad week and a bill. Left alone, it takes the domain with it. Mine did. I had a working agency, then a domain nobody could trust.
The difference is what you do in the next 48 hours. That part is still yours.
One case study. Not three.
Caught in about two days. Offline within 72 hours.
The site never went down and its real traffic never dipped. There was nothing to notice on the front end. There never is.
One real, de-identified client case. It shows what detection speed can mean; it is not a promise about your site. Read the case study, with what it doesn’t prove →
The Rescue Protocol
Five phases. In order. The order is the whole method.
For most small and medium sites, all five are covered by the $997 Site Rescue. Larger sites can need more, and you’ll see the scope and the cost before anything beyond $997 is done.
Contain
Site down, credentials rotated, attacker locked out, forensic snapshot taken. Stop it getting worse. Nothing gets cleaned yet.
Diagnose
Find the entry point: vulnerable plugin, stolen credential, compromised host, an old backdoor. Map every injected file, rogue account, scheduled task and backdoor. Attackers leave several.
Clean
Remove the infection and close the door. Not the other way round. Cleaning before you find the entry point hands the attacker a fresh site.
De-index
The half most “malware removal” services skip. Removal requests, correct status codes, sitemap cleanup, disavow where warranted, a security review request if there’s a manual action, and Search Console monitoring until the index is clear. Measured in weeks. It decides whether your traffic returns.
Close the door
The entry point the attacker used gets closed. Being clean doesn’t change everything else that was vulnerable, so full hardening and monitoring are quoted separately.
The SOS Site Rescue
Contain it. Clean it. Get back online.
- Contain and diagnose: attacker out, entry point found
- Clean: infection removed, door closed
- De-index: spam URLs out of Google, Search Console watched
- Report: what was found, what was fixed, every change logged
Full backup before any change. Not on fire? Start the Site Rescue online.
Larger sites
Will $997 be enough to remove the hack?
In most cases, yes: small and medium sites are usually fully recovered within the $997 Site Rescue. Larger sites can need more work. If yours does, you’ll know the scope and the cost before anything beyond $997 is done. Quoted up front, no hourly billing.
Ranking and AI visibility are not included at first. See all services →
Most people want to jump to Phase 3, because Phase 3 feels like fixing. Phases 1 and 2 are what make Phase 3 permanent.
You’re not the first person this happened to
You’re going to feel stupid. Don’t.
I ran a web agency. I built sites for a living. I still didn’t spot it until the phone went quiet. These attacks are engineered to be invisible to you. That’s not a failure of attention. That’s the product working as designed.
The difference between a bad month and a lost business is what happens in the next 48 hours.
Frequently asked questions
Straight answers.
My website has been hacked — what do I do first?
Take the site offline, change every password from a clean device, take a full forensic backup of the infected state, and stop touching it. Don’t delete spam pages or reinstall themes until forensics are complete.
How do I know if my website has been hacked if it looks completely normal?
Search site:yourdomain.com in Google and look at the page count — if it’s wildly higher than the pages you actually have, that’s your answer. Also check Google Search Console for security notices and manual actions, and review your admin user list for accounts you don’t recognize.
Can I just delete the spam pages and move on?
No, and it’s the most expensive mistake at this stage. Deleting pages removes the symptom while leaving the entry point open, so you’ll be reinfected — usually within weeks. It also destroys the forensic trail needed to find how they got in.
How long does it take to recover a hacked website?
Containment and clean-up typically take a few days to a week depending on how deep the infection goes. Getting your search visibility back is the slow part and runs from several weeks to several months, because de-indexing and rebuilding domain trust happen on Google’s timetable.
Should I just restore from a backup?
Almost never on its own, because your backups are probably infected. The compromise nearly always predates the day you noticed it — research puts average time-to-identify at 181 days — and most backup rotations don’t reach back far enough to hold a genuinely clean copy.
Also in Rescue
Clean is not the same as safe.
Stop guessing
Hacked right now? Call. Worried? It starts with the Site Rescue.
One fixed price. I find what’s wrong, fix what’s causing the damage, and tell you plainly what’s left. If anything beyond $997 is needed, you’ll see the scope and the cost first.
About Stevie
I lost my agency’s website to exactly this. Tens of thousands of spam pages built underneath a site that looked perfect in my browser. I found out when the calls stopped, and I had to take the whole thing down.
I rebuilt. Then I made this the thing I do, because when I needed someone who’d actually lived it, I couldn’t find one. The name came later, from a client who couldn’t pronounce mine and texted “SOS STEVIE” at midnight when his site went down. That story’s here.
I diagnose before I quote, because I know exactly what it costs to be certain about the wrong thing.
Frequently asked questions
My website has been hacked — what do I do first?
Take the site offline, change every password from a clean device, take a full forensic backup of the infected state, and stop touching it. Don't delete spam pages or reinstall themes until forensics are complete.
How do I know if my website has been hacked if it looks completely normal?
Search site:yourdomain.com in Google and look at the page count — if it's wildly higher than the pages you actually have, that's your answer. Also check Google Search Console for security notices and manual actions, and review your admin user list for accounts you don't recognize.
Can I just delete the spam pages and move on?
No, and it's the most expensive mistake at this stage. Deleting pages removes the symptom while leaving the entry point open, so you'll be reinfected — usually within weeks. It also destroys the forensic trail needed to find how they got in.
How long does it take to recover a hacked website?
Containment and clean-up typically take a few days to a week depending on how deep the infection goes. Getting your search visibility back is the slow part and runs from several weeks to several months, because de-indexing and rebuilding domain trust happen on Google's timetable.
Should I just restore from a backup?
Almost never on its own, because your backups are probably infected. The compromise nearly always predates the day you noticed it — research puts average time-to-identify at 181 days — and most backup rotations don't reach back far enough to hold a genuinely clean copy.
Also in Rescue
Stop guessing.
One diagnosis. Find it, fix it, get back online. Small and medium sites are usually fully recovered within the $997.
The Site Rescue starts the moment your order is placed. I’ll email you within one business day, usually much sooner, to get access and book the 30-minute intake call. If the site is under attack right now, call (754) 302-4631 after you pay.
The Backstory
Two years ago my own website was taken over. It looked completely normal in my browser while tens of thousands of spam pages ran underneath it. I found out when the calls stopped, and I had to take the whole thing down.
I diagnose before I quote, because I know exactly what it costs to be certain about the wrong thing. The whole story is here.