First aid: what you should do in the first hour after a hack

Stay calm and don't delete anything

The first impulse is often to remove suspicious files or quickly restore an old backup. Both feel right, but usually only shift the problem: the gap remains open, and the attacker comes back the same way.

The right order

• Note when you noticed what, and take screenshots of warnings or unfamiliar content.
• Change passwords for hosting, FTP and email from a clean device.
• If customer data or payments could be affected, put the site into maintenance mode.
• Inform the host, or calmly read its notification: what exactly was found?
• Save a complete copy of files and database in their current state, as evidence.
• Bring in experts who systematically look for the cause and the malicious code.

Communicating correctly internally and externally

Inform everyone with access to the website early, such as your agency, staff or service providers. This prevents someone from making changes in parallel or continuing to use a compromised password.

Whether you have to inform customers or authorities depends on whether personal data may be affected. The deadline for this is short, so the question should be clarified the same day.

What follows after the first hour

The emergency measures are followed by analysis, clean-up, hardening and finally the lifting of blocks and warnings. Those who keep to this order have the best chance that the hack remains a one-off.