Isolate
Maintenance mode, access cut off.
Website design · 2026 edition
Hacked website: what to do, step by step
Defaced page, redirect to a dubious site, a warning from Google or your browser: your website has probably been hacked. Do not panic, but do not wait either. Here are the steps in order.
- The first hour
- Clean up and relaunch
- Notify the right people
Updated October 2026Rules checkedNo jargon
The right reflexes in 30 seconds
In short
If your website is hacked, put it into maintenance mode, change every password (hosting, admin, email, domain name) and keep evidence. Then restore a clean backup, update everything, and ask Google to review the website if it shows a warning. If personal data may have been affected, the breach must in principle be notified to your data protection authority within 72 hours. You can report it to the police and get help from your country's cybercrime reporting service.
Change access details
Every password, with two-factor authentication.
Keep evidence
Screenshots, dates, server logs.
Restore
A backup from before the attack.
The plan in 6 steps
In order. The first three within the first hour.
Who to notify and when?
Deadlines run from the moment you become aware of the incident.
| Who | When | Why |
|---|---|---|
| Your web host | Immediately | Technical help and logs |
| Your data protection authority | Within 72 h if personal data is involved | Article 33 of the GDPR |
| The people concerned | If there is a high risk to them | Article 34 of the GDPR |
| The police | As soon as possible | Report, with help from your national cybercrime service |
| Your insurer | Depending on your policy | Possible cyber cover |
Even when notification is not required, the breach must be recorded in an internal register. Have your situation checked by a professional if customer data is involved.
Stop it happening again
Most hacks of small websites come through a known weakness.
Updates
A website that is not updated is the most common target.
Backups
Automatic, stored elsewhere, tested.
Passwords
Unique, long, with two-factor authentication.
Access
Remove accounts belonging to former contractors.
From a one-page site to a website that works for you
Choose the package that fits your business. The price is fixed in advance.
Simple Website · 1 page
A one-page website, simple and professional, to be present online.
- 1 mobile-friendly page
- Your copy and your logo
- WhatsApp button
- 1 round of changes included
- File delivered, ready to publish
Essential Website
For a small business that wants a serious website, fast.
- Up to 5 pages
- Copy written for you
- Basic SEO
- Contact form
- Publishing included
Multilingual Pro Website
To reach customers in several languages.
- 5 to 10 pages
- 2 or 3 languages
- Full SEO
- Form linked to a tracking spreadsheet
- WhatsApp button and direct contact
Website + Automations
For a website that works for you, day and night.
- Everything in the Multilingual Pro Website
- Quotes calculated and sent
- Orders recorded automatically
- Automatic invoices and reminders
Online Presence Pack
Everything you need to exist on Google, set up for you.
- Domain name in your name
- Professional email address
- Business Google account
- Your website registered with Google
Options, for every offer
- €29Domain name purchase and setup
- €49Going live on hosting
- €39Extra page with copywriting
- €59Translation, per language
- €19/monthWebsite monitoring and alerts
The website and the domain name are in your name. Simple Website: text and logo supplied by you, going live as an option. Indicative prices.
A website that is monitored, backed up and up to date
Our monthly subscriptions take care of routine security: Website Watch at €19/month, Worry-Free Website at €49/month. Three months minimum, then cancel any month. The website and the data remain yours.
Monitoring
You are alerted if the website goes down.
Regular backups
Stored separately, ready to restore.
Managed updates
Known security holes are fixed.
Fast alerts
If something looks wrong, we let you know.
Your questions, our answers
How do I know if my website has been hacked?
Changed pages, strange redirects, a warning from Google or your browser, emails sent without your knowledge, unknown new accounts.
Do I need to notify my data protection authority if my website is hacked?
Yes if personal data may have been affected and there is a risk to people, in principle within 72 hours.
Where do I report a hacked website?
To the police. Your country's cybercrime reporting service can also guide victims.
How long does it take to remove Google's warning?
Google reviews the website after your request, usually within a few days.
Is my web host responsible?
It depends on the contract and on where the security hole came from. An add-on that was not updated is usually part of managing the website.
Sources: GDPR, Articles 33 and 34 · guidance from your data protection authority on notifying a personal data breach · your national cybersecurity agency (first steps after a cyberattack) · Google Search Central, help for hacked sites.
General information, up to date as of October 2026. It does not replace advice from a professional.
Free quote
What if we automated all this for you?
Tell us about your project. We study it in detail, then you receive a personalised study and a clear quote in writing, within 24 business hours. No meeting, no obligation.
What happens after your request
Or by email: contact@growthsystemexperts.com