Your website was hacked and used for phishing: what to do now
If a phishing page turned up on your domain, you are the second victim, not the attacker. But to a browser, a blocklist and your customers, the difference is invisible until you fix it. This is the order of operations that gets you back to normal with the least damage.
The first hour
Three things, in this order:
- Preserve. Copy the malicious files and the web and access logs covering the period to somewhere outside the server. Note the exact times.
- Contain. Remove the phishing files, or put the whole site behind a maintenance page. Every additional visitor is a potential victim.
- Lock. Rotate the hosting control panel password, the administrative accounts, the database password, any API keys and any FTP or SSH credentials. Assume all of them are known to the attacker.
Do not reply to the attacker if there is a note, and do not pay anything. Phishing kits are dropped by automation, not by someone negotiating with you.
Find the entry point, not just the page
The visible phishing folder is the symptom. If you remove it without finding the way in, it comes back, usually within a week. Typical entry points:
- An outdated content management system, theme or plugin with a public exploit.
- A reused or leaked administrator password, often taken from an unrelated breach.
- A compromised developer or agency machine with saved credentials.
- A neglected second installation on the same hosting account — an old staging copy is the classic case.
Then look for what was left behind: unexpected admin users, modified core files, unknown scheduled tasks, new files in upload directories, and injected code in theme or configuration files.
Clean properly
- Restore from a backup taken before the compromise where possible, then apply all updates before putting it back online.
- If no clean backup exists, rebuild the platform from official sources and move only your own content and data across, after inspecting it.
- Update everything: platform, themes, plugins, server packages.
- Re-check that the credentials you rotated were all of them, including any shared with third-party services.
- Verify with the site status check that only what you expect is answering.
Getting the browser warning lifted
Once the site is genuinely clean, request a review with each blocklist that flagged you. Be honest about what happened and what you fixed. Reviews are normally processed quickly, but a premature request while a backdoor is still live will put you back on the list and make the next review slower.
The submission and review routes are described in the Safe Browsing guide. If your hosting provider sent you an abuse notice, reply to it with what you did — that reply is often what stops the account being suspended.
Who you need to tell
If the page captured credentials or personal data, the people affected need to know, and depending on where you and they are, you may have a legal obligation to report the incident to a supervisory authority within a fixed deadline. Check that obligation early — the deadlines are short and start when you become aware, not when you finish cleaning up.
Fraudpol treats a compromised legitimate site differently from a purpose-built scam domain: such cases are never published with the domain in the clear. If your site was used and you want the hosted content reported through the proper channels, open a case and mark it as a compromised site.
Have a URL to report right now?
Fraudpol triages the case, files with the right blocklists and opens a takedown with the hosting provider: usually within minutes.
Report a website to FraudpolRelated guides
Frequently asked questions
Should I delete the phishing files immediately?
Take them out of reach of visitors immediately, but copy them and the surrounding logs first. Those files and timestamps are usually the only way to find how the attacker got in, and deleting them without a copy often means the site is re-compromised within days.
How do I get the red browser warning removed?
Clean the site properly, then request a review through the blocklist's own channel. Reviews are usually processed within a day or so once the malicious content is genuinely gone. Requesting a review while a backdoor is still present resets the clock and can extend the warning.
Will my domain be suspended?
Registrars generally suspend domains that exist to commit abuse, not compromised legitimate sites. Responding quickly and communicating with your hosting provider is what keeps you in the second category. Ignoring abuse notices is what moves you into the first.