Website got hacked and is redirecting visitors — what should we do in the first hour?

First things first: download your server config file via FTP and inspect it. They usually bury external redirects disguised as strings of gibberish right between rewrite rules. If you know what the original file looked like, delete those suspicious lines and save; at least the redirecting will stop temporarily.

The redirect only triggering on mobile and from search engines is a classic referer check. The malicious code might not just be in core files—it could also be written straight into database settings tables. If you have SSH access to the server, you can instantly find suspicious files by searching for anything modified in the last 48 hours.

When submitting a ticket to your host, make sure to include these three details: 1) Which devices and referrers trigger the redirect, 2) The exact time and date the issue was first spotted, 3) Whether any unauthorized, unknown files were created in the directories. That way they escalate it straight to security instead of giving you a canned response.

The exact same thing happened to our wholesale site in Frankfurt last year. In a panic, we restored yesterday's backup and two hours later it got hacked again because there was a vulnerability in an outdated form plugin. We lost 2,000 Euro a day. Just restoring a backup without patching the exploit is definitely not a permanent fix.

note: I wrote this based on my own experience, it might not apply to everyone.

Did you have any third-party themes or plugins installed that haven't been updated in a long time? Also, are you on a shared hosting plan or a dedicated VPS? If it's shared, there's a very high chance it spread from another site on the same server.

if the hosting company has an auto-backup whatever you do dont overwrite it right away. btw first take a backup of the current infected state and put it asidde and sometimes yesterdays backup that you think is clean is actually infected too you might need to go back at least a week.

Since you operate in the German market, investigating whether user data has been leaked is critical regarding your legal obligations. If there is any possibility of access to customer details or checkout pages, you may be legally required to report the incident to the relevant state data protection authority.

Check Search Console immediately; if a warning has been flagged under the security issues tab, you will need to request a review right away as soon as the cleanup is done.

Great work. Trying to do this alone is the most expensive way.

If you post the result here it will help others too.

Three different views emerged, they all complement each other. An automated scan report is not the same as a penetration test.

Let's separate the concepts, they're getting mixed up. Taking measures without an inventory leaves doors you haven't seen open.

If you don't write this down from the start, it leads to arguments later. If you have questions, write them; I'll answer as best I can.

Here's how it went for us. People defend habits, not processes. Resistance comes from there.

Hope this helps.

Following.

here's how it went for us... having backups accessible on the same network and with the same identity makes them part of the target.

im also curious if anyone does it differently.

Quick summary for newcomers: Having backups accessible on the same network and with the same identity makes them part of the target.

Of course, it varies if your situation is different.

I've been down this road, let me tell you. Hasty decisions become decisions you have to fix six months later.

If permission and scope aren't in writing, don't start that test. If you post the result here, it will help others too.

I have a question. Most incidents start with a leaked password, not a vulnerability.

Correct me if I'm wrong.

If you're going this route, sort this out first. Start with a small trial; don't commit to everything at once.

When making decisions, write down the worst-case scenario too, not just the best. If you have questions, write them; I'll answer as best I can.