Website hacked? Here's what to do, how to fix it and how much it costs

Has your business website been hacked? Whether you're dealing with malicious code, unexpected redirects, spam appearing in Google or a website that's stopped working altogether, the important thing is to act quickly.

A hacked website can cause serious problems for a business. Beyond the immediate disruption, there's the potential loss of enquiries, damage to your reputation, reduced search engine visibility and, in some cases, risks to customer data.

The good news is that most compromised websites can be recovered with the right technical expertise.

At Show + Tell, we've spent 17 years designing, developing, hosting and maintaining websites for businesses across the UK, Europe, the US and beyond. Our experienced development team helps businesses investigate website security incidents, remove malicious code, repair compromised websites and implement stronger security measures to reduce the risk of future attacks.

In this guide, we'll explain the most common types of website hacks, how to recognise the warning signs, what to do if your website has been compromised and how much professional website recovery typically costs.

And if you need immediate help, we're here.

Need help with a hacked website?

Our developers can investigate compromised websites across WordPress, WooCommerce, Webflow, HubSpot, Payload CMS, Next.js and bespoke platforms.

We offer a free initial consultation, with website investigation and repair typically costing between **£800 and £2,000 + VAT**, depending on the complexity of the problem.

Contact Show + Tell

How do I know if my website has been hacked?

Not every website hack is immediately obvious. While some attacks cause a website to go offline or display unwanted content, others can remain undetected for weeks or even months.

In fact, some of the more damaging website security incidents happen quietly in the background, with business owners completely unaware that their website has been compromised.

Here are some of the most common warning signs.

1. Your website is redirecting visitors to another website

One of the most common symptoms of a hacked website is an unexpected redirect. Visitors might click on your website through Google, only to be sent to a completely unrelated website promoting gambling, cryptocurrency, adult content or other suspicious services.

Sometimes these redirects only happen on mobile devices or when someone arrives through a search engine, making them particularly difficult to identify.

These attacks are often caused by malicious code injected into website files, compromised plugins or unauthorised changes to server configurations.

2. Spam pages are appearing in Google

Have you searched for your business on Google and discovered hundreds of unfamiliar pages appearing in the results?

This is a common form of SEO spam attack, sometimes referred to as SEO poisoning.

Hackers can exploit vulnerabilities to generate large numbers of unwanted pages on your website, often targeting gambling, pharmaceuticals, counterfeit products or other unrelated search terms.

These pages can appear in your XML sitemap, Google Search Console and website analytics.

Left unresolved, this can damage your search visibility, undermine trust in your business and make it harder for legitimate customers to find you.

3. Google is warning visitors that your website is dangerous

If Google detects malware, deceptive content or other security threats, it may display a warning to users before allowing them to visit your website.

Messages such as "Deceptive site ahead" or "This site may harm your computer" can have a significant impact on traffic and customer confidence.

Google Search Console may also contain notifications about security issues that need resolving.

It's important to understand why your website has been flagged, remove the underlying problem and follow Google's review process where appropriate.

4. Your website has suddenly stopped working

Not every website outage is caused by a hack, but unexpected errors, missing content, broken functionality or an inaccessible admin area can indicate that something has gone wrong.

In some cases, attackers deliberately disrupt a website. In others, the damage is a side effect of malicious code, modified files or compromised server resources.

The first step is establishing whether the problem is security related or caused by another technical issue.

5. Unauthorised changes have appeared on your website

You might discover unfamiliar administrator accounts, unexpected changes to website content, modified files or plugins that nobody remembers installing.

These can indicate that someone has gained unauthorised access to your website or content management system.

Even if the website appears to be functioning normally, these warning signs should be investigated.

What are the most common types of website hacks?

Website attacks come in many forms and the methods used by hackers continue to evolve.

Understanding the type of compromise is important because the right recovery approach depends on how the attacker gained access and what they've changed.

Malware and malicious code injection

Malware is software or code introduced into a website without authorisation.

It can be used to redirect visitors, steal information, create spam pages, provide attackers with ongoing access or interfere with website functionality.

Malicious code can be hidden within website files, plugins, themes, databases or server configurations.

Simply deleting a suspicious file isn't always enough. Unless the original vulnerability is identified and addressed, the website may become compromised again.

SEO spam and sitemap injection

SEO spam attacks are designed to exploit your website's reputation and visibility in search engines.

Attackers may generate hundreds or thousands of unwanted pages, insert spam links into existing content or manipulate your website's sitemap.

These attacks can be particularly frustrating because the website might appear completely normal to visitors while Google is discovering and indexing malicious content in the background.

Resolving the issue typically involves removing the unwanted content, identifying how it was created, securing the website and helping search engines recognise the cleaned up version.

Malicious redirects

A malicious redirect sends visitors away from your legitimate website to another destination.

Attackers may use JavaScript, modified server configuration files, compromised plugins or injected database content to control where visitors are sent.

Because some redirects are conditional, they can be difficult to reproduce and diagnose without a thorough investigation.

Website defacement

Website defacement occurs when an attacker changes the appearance or content of your website without permission.

This might involve replacing the homepage, displaying offensive content or publishing messages intended to demonstrate that the website has been compromised.

Although the visible damage can sometimes be repaired quickly, it's important to investigate whether the attacker has retained access to the website or server.

Administrator account compromise

Sometimes the vulnerability isn't in the website code itself.

Weak passwords, stolen credentials, phishing attacks and compromised user accounts can allow attackers to access a website through legitimate administration tools.

Once inside, they may be able to install malicious software, change content, create new accounts or access sensitive information.

This is one reason we recommend stronger authentication, appropriate access controls and regular reviews of administrator permissions.

Can WordPress, WooCommerce, Webflow and other CMS websites be hacked?

Yes. However, the security risks and recovery processes vary considerably depending on the platform, hosting environment and how the website has been developed.

At Show + Tell, our developers work across a wide range of content management systems and website technologies.

WordPress website hacked

WordPress is one of the world's most widely used content management systems, making it a frequent target for automated attacks.

Common vulnerabilities can arise from outdated plugins, unsupported themes, weak administrator credentials, insecure hosting configurations or unpatched software.

A hacked WordPress website might display spam content, redirect visitors, create unauthorised administrator accounts or become infected with malicious code.

Our WordPress recovery process typically involves investigating the installation, reviewing plugins and themes, inspecting files and databases, removing malicious code and addressing the vulnerabilities responsible.

Where appropriate, we can also migrate the website to a more secure hosting environment.

WooCommerce website hacked

WooCommerce websites face many of the same security risks as WordPress websites, with the additional consideration that they're handling ecommerce transactions and customer information.

A compromised WooCommerce website could expose customer data, interfere with checkout functionality, redirect customers to fraudulent payment pages or disrupt trading.

Recovering an ecommerce website requires particular care to protect customer information, preserve order records and minimise disruption.

If a breach may have affected personal data or payment information, additional investigation, notification and compliance obligations may apply.

Webflow website security issues

Webflow operates differently from traditional self hosted CMS platforms.

Because Webflow manages much of the underlying hosting infrastructure, its websites aren't exposed to the same plugin and server maintenance risks commonly associated with WordPress.

However, security incidents can still occur through compromised user accounts, malicious custom code, third party integrations, domain configurations or external services.

Our team can investigate these issues, identify the affected systems and help restore the website's security.

HubSpot CMS website security issues

HubSpot CMS benefits from a managed hosting infrastructure, but websites can still be affected by compromised accounts, inappropriate permissions, third party integrations or malicious custom code.

Recovery may involve reviewing account access, checking integrations, inspecting website content and working with HubSpot support where necessary.

Payload CMS, Next.js and bespoke websites

Modern frameworks and bespoke websites offer considerable flexibility, but they also require careful security management.

Vulnerabilities can arise through outdated dependencies, insecure API endpoints, authentication weaknesses, exposed credentials, application code or hosting configurations.

Our developers can investigate these environments, review the underlying codebase and work to identify and resolve the cause of a compromise.

The important thing to remember is that **no website should be considered completely immune to security incidents**.

Good development practices, secure hosting, appropriate access controls and ongoing maintenance all play an important role in reducing risk.

What should you do immediately if your website has been hacked?

If you suspect your website has been compromised, acting quickly can help limit the damage.

First, avoid making unnecessary changes to the website before the issue has been investigated. Deleting files, restoring an old backup or installing additional security plugins without understanding the problem can sometimes make recovery more difficult or destroy useful evidence.

Contact your website developer, hosting provider or a specialist agency that can investigate the incident.

Depending on the circumstances, it may also be necessary to restrict access to the website, temporarily disable affected functionality, secure administrator accounts and preserve backups or server logs.

If your website handles customer information, ecommerce transactions or other sensitive data, it's particularly important to establish whether any information has been accessed or exposed.

For UK businesses, certain personal data breaches may need to be reported to the Information Commissioner's Office within 72 hours of becoming aware of the breach.

The priority is to contain the incident, understand what happened and recover the website safely rather than simply getting it back online as quickly as possible.

How Show + Tell fixes hacked websites

We've developed a practical process for investigating and recovering compromised websites.

Every incident is different, but our approach is built around identifying the underlying problem, restoring the website and improving its security.

Step 1: Initial consultation and investigation

We start by discussing what's happened, when the problem first appeared and how it's affecting your business.

Our developers then review the available information to understand the likely nature of the compromise and establish the next steps.

This may involve accessing your website's CMS, hosting environment, server files, databases, logs and Google Search Console.

We'll explain our recommended approach and provide an indication of costs before proceeding.

Step 2: Secure the website and prevent further damage

Depending on the nature of the incident, we may need to temporarily restrict access, secure compromised accounts, preserve backups or isolate affected systems.

The objective is to prevent further damage while maintaining the information needed to investigate what happened.

Step 3: Identify the vulnerability

This is one of the most important stages.

Rather than simply removing the visible symptoms, we investigate how the attacker gained access in the first place.

Our developers may review the website's codebase, CMS configuration, plugins, themes, user permissions, hosting environment and third party integrations.

Identifying the original vulnerability helps us address the cause of the problem rather than just its consequences.

Step 4: Remove malicious code and repair the website

Once we've identified the affected areas, we work to remove malicious files, unwanted content and unauthorised changes.

Depending on the website, this may involve cleaning the codebase in a local development environment, repairing database records, updating software or restoring verified clean components.

We then address the identified vulnerabilities before preparing the website for deployment.

Step 5: Test and restore the website

Before returning the website to normal operation, we test its functionality and check for signs of remaining malicious activity.

This can include reviewing key user journeys, checking website forms, inspecting redirects, validating security configurations and confirming that the original issue has been resolved.

Where appropriate, we also review Google Search Console and help address any outstanding security notifications or unwanted indexed URLs.

Step 6: Strengthen security and reduce future risk

Getting your website working again is only part of the solution.

We also recommend improvements to strengthen security and reduce the likelihood of another incident.

Depending on your website, these measures could include stronger authentication, including single sign on (SSO) and multifactor authentication where supported, improved server security, Cloudflare firewall protection, regular CMS updates, automated backups, website monitoring and ongoing technical maintenance.

We can implement these improvements as part of the recovery project or through an ongoing website maintenance agreement.

A quick response when you need it most

We understand that discovering your website has been hacked can be an incredibly worrying experience. It's not just a technical problem. For many businesses, their website is a vital source of enquiries, sales and customer communication.

Anton Pankevych, Senior Developer at Show + Tell, explains:

"When a business discovers its website has been hacked, it can leave people feeling incredibly vulnerable. There's often a lot of uncertainty about what's happened, what's been affected and how quickly things can be fixed. We understand how stressful that can be, which is why speed is so important. Our priority is to get to the bottom of the problem, get the website back up and running as quickly and safely as possible and take that stress off our clients' plates. We want them to feel confident that the issue is being handled by people who know what they're doing."

Real examples of website security incidents we've resolved

Website security problems aren't always obvious and we've helped businesses recover from different types of incidents.

Here are two examples of how our development team has approached website recovery.

Case study: Energy business affected by SEO spam

An energy business experienced a search related security issue involving spam backlinks and concerns about its visibility in Google.

Our SEO team investigated the issue, identified the unwanted links and worked to clean up the problem.

Where appropriate, we followed Google's guidance and used Google Search Console's disavow process to address harmful backlinks.

It's worth noting that not every suspicious backlink requires disavowing. Google's guidance recommends using this tool selectively, particularly where there's a significant volume of artificial or spammy links and a genuine risk of manual action.

The project demonstrated how website security issues can extend beyond the website itself and affect a business's wider search engine presence.

Case study: Professional services website compromised by malicious code

A professional services firm contacted us after discovering that its website had been compromised.

Hundreds of unwanted spam URLs had appeared in the website's sitemap and analytics, creating concerns about security, search visibility and the integrity of the website.

Our developers investigated the incident and recommended migrating the website to a new server environment.

We worked on the codebase locally, identified the underlying vulnerability and removed the malicious content.

Once the website had been cleaned and secured, we deployed the repaired version to the live environment.

By addressing both the immediate compromise and the underlying vulnerability, we were able to restore the website rather than simply remove the visible spam.

How much does it cost to fix a hacked website?

One of the first questions businesses ask us is how much website recovery will cost.

The answer depends on the nature of the compromise, the size and complexity of the website, the hosting environment and the extent of the damage.

Some issues can be identified and resolved relatively quickly. Others require a more detailed investigation, particularly where malicious code has spread across multiple files, databases or connected systems.

At Show + Tell, we believe in being transparent about costs.

Our website hack recovery pricing

• Website investigation, malware removal and repair - £800 to £2,000 + VAT
• Website migration to a new hosting environment - Typically £400 + VAT
• Ongoing website hosting, security updates and maintenance - From £200 + VAT per month
• Emergency or priority website recovery - Quoted individually based on urgency and availability

Our typical website recovery projects cost between £800 and £2,000 + VAT, although more complex incidents may require additional work.

We'll discuss the issue with you, review the available information and explain the likely costs before getting started.

If our investigation reveals a more extensive problem than originally anticipated, we'll explain the findings and agree any additional work before proceeding.

For businesses requiring urgent assistance, we can also discuss priority support, subject to developer availability, with costs confirmed on the day.

Can you fix my hacked website without moving hosting providers?

Yes.

We're happy to investigate and repair websites hosted with existing providers, provided the environment meets appropriate security standards and we have the access needed to complete the work.

However, if we identify weaknesses in the hosting infrastructure, we may recommend moving to a more secure environment.

We can manage this migration for you, with a typical website migration costing around £400 + VAT.

How long does it take to fix a hacked website?

Recovery times vary depending on the nature of the incident.

Some straightforward problems can be investigated and resolved within one or two working days once the necessary access is available.

More complex compromises, particularly those involving extensive malware infections, damaged databases, compromised servers or multiple affected systems, can take longer.

If Google has flagged your website as unsafe or indexed malicious content, the technical repair may be completed before Google has finished reviewing or updating its search results.

We'll always aim to explain the likely timescales once we've assessed the problem.

For businesses facing a particularly urgent incident, we can discuss priority investigation and recovery options.

Why ongoing website maintenance is essential

One of the biggest misconceptions about websites is that once they're built and launched, they can simply be left alone.

Unfortunately, that's not how websites work.

Think of your website like a car.

You wouldn't buy a new car, drive it every day for five years and expect it to remain reliable without servicing, maintenance or occasional repairs.

Your website is no different.

Content management systems evolve. Software dependencies are updated. New vulnerabilities are discovered. Security standards change. And attackers are constantly looking for weaknesses they can exploit.

A website that was secure when it launched several years ago may not meet today's security requirements.

This is particularly important for WordPress and WooCommerce websites, where outdated plugins, themes and CMS installations can introduce avoidable security risks.

But it also applies to bespoke applications, integrations, hosting infrastructure and user access across other platforms.

Website security isn't a one off exercise. It's an ongoing responsibility.

At Show + Tell, we provide ongoing website hosting, security updates and maintenance from £200 + VAT per month.

Depending on the platform and agreed service, this can include secure hosting, software security updates, backups and appropriate monitoring.

We take a proactive approach to website maintenance, helping businesses identify and address potential problems before they become more serious.

And while no provider can guarantee that a website will never be hacked, regular maintenance and appropriate security controls can significantly reduce the risk.

Taking a proactive approach to website security

For us, website security isn't just about responding when something goes wrong. It's about building lasting relationships with our clients and taking responsibility for the ongoing health and security of their digital infrastructure.

Charlie Hartley, Managing Director at Show + Tell, explains:

"Of course, when a website gets hacked, the immediate priority is getting that business back up and running as quickly as possible. But for us, that's only part of the job. We want to build long term relationships with our clients where we're proactively looking after their websites and wider digital infrastructure, rather than just waiting for something to break. Cyber security is becoming increasingly important and businesses can't afford to treat their website as something they launch and then forget about. We want our clients to have complete confidence that their digital infrastructure is being properly maintained, monitored and protected, so they can focus on running and growing their business."

Why choose Show + Tell to fix your hacked website?

There are plenty of website security tools and specialist services available.

But when a business website has been compromised, the challenge often goes beyond simply detecting and removing malware.

You need someone who understands how the website has been built, how it interacts with its hosting environment, how to repair damaged functionality and how to get everything working again.

That's where our experience makes a difference.

Show + Tell is an established digital agency with 17 years of experience delivering websites and digital experiences for businesses across the UK, Europe, the US and internationally.

Our in house development team works across WordPress, WooCommerce, Webflow, HubSpot, Payload CMS, Next.js and bespoke website technologies.

We understand the underlying architecture of these platforms, which allows us to investigate security incidents, repair compromised websites and recommend improvements to their long term reliability.

We're also proactive in how we work.

Rather than simply removing the immediate problem and walking away, we look at the wider picture. Is the hosting environment secure? Are software updates being managed? Are access permissions appropriate? Could the same vulnerability be exploited again?

Our aim is to help you recover from the immediate incident and put your website in a stronger position for the future.

Frequently asked questions about hacked websites

Can a hacked website be fixed?

Yes. Most hacked websites can be repaired, although the recovery process depends on the extent of the compromise. This may involve removing malware, repairing files, restoring clean backups, addressing vulnerabilities or migrating to a secure hosting environment.

How much does it cost to remove malware from a website?

At Show + Tell, website investigation, malware removal and repair typically costs between £800 and £2,000 + VAT. More complex incidents may require additional work, which we'll discuss before proceeding.

Can you fix a hacked WordPress website?

Yes. Our Wordpress developers can investigate compromised WordPress websites, remove malicious code, repair functionality, address vulnerabilities and implement stronger security measures. We also support WooCommerce websites.

Can you recover a website that's been blacklisted by Google?

We can investigate and resolve website related security issues that have caused Google to flag a website as unsafe. Once the underlying problem has been addressed, we can help you follow Google's review process. Where a website has been affected by SEO spam, we can also investigate unwanted pages and links.

Can hackers steal customer data from a website?

Potentially, yes. Depending on the nature of the compromise, attackers may be able to access customer information or other sensitive data. If you suspect a personal data breach, it's important to investigate promptly and assess any legal or regulatory reporting obligations.

Do I need to rebuild my website after a hack?

Not necessarily. In many cases, a compromised website can be cleaned and repaired without requiring a complete rebuild. However, if the website is significantly outdated, unsupported or fundamentally insecure, rebuilding may be the more appropriate long term solution.

Can you fix my website if another agency built it?

Absolutely. We regularly work with businesses whose websites were originally designed and developed by other agencies or developers. Provided we can obtain the necessary access, we can investigate the issue and recommend a recovery approach.

Do you offer emergency website hack recovery?

Yes, subject to developer availability. If your website has been compromised and requires urgent attention, contact our team to discuss the issue. We'll assess our availability and provide a quote for priority support.

How can I stop my website from being hacked again?

The best approach is to maintain appropriate security controls, keep software updated, use strong authentication, review user permissions, maintain reliable backups and monitor the website for suspicious activity. Ongoing professional website maintenance can help reduce the risk of future incidents.

Has your website been hacked? Get help from Show + Tell

If your website has been compromised, the sooner you investigate the issue, the better.

Whether you're dealing with a WordPress malware infection, a WooCommerce security problem, malicious redirects, unwanted spam pages or a more complex website compromise, our developers can help.

We offer a free initial consultation to understand the problem and discuss the best way forward.

To help us assess the issue, it's useful if you can provide your website address, the CMS platform your website uses, a brief description of the problem, when you first noticed the issue and whether your website is still accessible.

It also helps to know who currently hosts your website, whether you have recent backups and whether you've already contacted your hosting provider or attempted any repairs.

Don't worry if you don't have all this information. We can help you work through it.

Our website recovery projects typically cost between £800 and £2,000 + VAT, with ongoing hosting and security maintenance available from £200 + VAT per month.

Get your website back on track

Contact Show + Tell or call our team to discuss your website security issue.

We'll help you understand what's happened, what needs fixing and the best way to move forward.