What happens if your website gets hacked?
How small-business sites usually get hacked, the signs to watch for, what to do in the first hour, and the basics that prevent most of it.
What you’ll learn
- How most small sites actually get hacked
- Warning signs to watch for
- What to do first, and what not to do
- The prevention basics that stop most attacks
Why it matters
Most hacked small-business websites weren’t targeted. They were found automatically through weak passwords and out-of-date software.
How it usually happens
Reused or weak passwords, software and plugins left un-updated, and old accounts nobody removed. Automated programs scan the internet for exactly these.
Signs something is wrong
Pages or links you didn’t add, visitors sent to strange sites, browser warnings, Google showing odd text under your listing, emails bouncing, or a sudden drop in traffic.
The first hour
Don’t delete anything yet; it helps to see what changed. Take screenshots, note when you noticed, and change the passwords for your hosting, website editor and email from a computer you trust. Then contact your host or web team, who can clean the site and restore a clean backup.
If customer information could be involved, ask a qualified professional about your obligations.
Prevention basics
The padlock (HTTPS) on every page. A long, unique password for each account in a password manager. Two-step verification wherever it’s offered. Regular software updates. Backups you’ve confirmed can be restored.
Your toolbox
Use it today
1) Don’t delete anything yet. 2) Change the passwords for your hosting, website editor and email from a trusted computer. 3) Note what you saw (screenshots help) and when. 4) Contact your host or web team, or send a Website Rescue request, so it can be cleaned and restored from a backup.
Free tools to check your own site
Implementation Lab · 15 min
Put it to work: Security Preparedness Checklist
You’ll confirm the prevention basics and have a written first-hour plan with the right contacts.
You’ll finish with: A completed checklist and an incident contact plan.
Do this next
- 1
Check the padlock shows on every page.
- 2
Change any password you’ve reused.
- 3
Turn on two-step verification.
- 4
Complete the Security Preparedness checklist, including who to call.
Verification checklist
How you’ll know it’s done
Common mistakes
- Reusing the same password everywhere
- Deleting files in a panic before anyone sees what changed
- Having no backup to restore from
Quick answers
My site shows a warning in Chrome. What now?
Don’t ignore it. Check Google’s Safe Browsing status for your domain and contact your web team; most warnings come from a missing padlock or a hacked file.
Is a website builder safer?
Builders handle server updates for you, but your logins still need strong, unique passwords and two-step verification.
Your one next step
Complete your security plan →Next recommended lesson
Lesson 17: Why is your website loading slowly? →Level 3 · Professional implementation
Rather not do it yourself?
Send the work to the TL Web Design team through Client Updates. We review what you need and send an estimate when one applies. Nothing changes on your website and nothing is charged until you approve it.
Have Our Team Implement ThisYour progress is saved on this device.