Website down or hacked: restoring from backup step by step

How to recognize the problem

• Website shows a 500 error, white screen or database error message
• Unknown links, ads or pages you did not create appear on the site
• New administrator accounts or unknown files appear in the directory
• Google shows a dangerous site warning or the site is removed from the index
• Hosting suspended the account due to suspicious activity or resource overuse

Most common causes

Step-by-step fix

1. 1

   Isolate the site and preserve evidence

   Do not delete files or reinstall. If the site is hacked, switch it to maintenance mode or temporarily disable public access. Save a copy of the current state (files and database) for analysis, then change access credentials (FTP, database, administrator account) as soon as possible.

2. 2

   Determine the time of the incident

   Review the access log and error log on the hosting (usually in the control panel, e.g. cPanel or Plesk, in the logs or statistics section, or in the log directory specified by your hosting). Note the date and time when suspicious activities or errors appeared. This is crucial for choosing a backup created before that moment.

3. 3

   Find the appropriate backup

   In the hosting panel, look for the backup section (e.g. Backup or Backup Wizard). If the hosting makes automatic daily backups, choose the one from before the incident. If you do not have a hosting backup, check if you have your own copy (backup plugin, manual export of database and files).

4. 4

   Restore website files

   Via FTP or the hosting file manager, rename the current site directory (e.g. public_html to public_html_old) and unpack the backup archive. Do not delete the old directory until you verify everything works. Be careful not to overwrite configuration files if they are not part of the backup. If possible, first restore the site to a local development environment for verification.

5. 5

   Restore the database

   In the database panel (e.g. phpMyAdmin), create a new database or, if using an existing one, first export it. Then, if necessary, delete existing tables and import the .sql file from the backup. If the table prefix differs, adjust the site configuration. Verify that all tables were imported without errors.

6. 6

   Verify integrity and remove malicious code

   Compare website files with the original version (e.g. by re-downloading WordPress core and themes). Check wp-config.php, .htaccess and the uploads directory for suspicious files. If you find unknown files or code, isolate them (rename or move outside the public directory) and note the paths.

7. 7

   Reset passwords and keys

   Change the password for the hosting panel, FTP, database and all administrator accounts on the site. In WordPress, replace the SALT keys in wp-config.php with new values (e.g. using the generator at api.wordpress.org/secret-key/1.1/salt/). Remove unknown users; changing SALT keys will log out all active sessions.

8. 8

   Update everything and put the site back online

   Update core, themes and plugins to the latest versions, remove unnecessary plugins and themes. Verify that the site works correctly, then return it to public mode. Monitor logs for the next 24 hours.

9. 9

   Report the issue and clean up reputation

   If the site was on Google's dangerous sites list, submit a request for review in Google Search Console. If the hosting suspended the account, contact support explaining what you did. Check if emails were compromised and notify users if there was a data breach.

If nothing helps: advanced check and isolation

How to prevent it

• Regularly make backups (files and database) and store them off-hosting, at least 30 days back.
• Update core, themes and plugins immediately, and remove everything you do not use.
• Use strong, unique passwords and two-factor authentication for administrators and the hosting panel.
• Monitor logs and set up notifications for failed logins and file changes.

FAQ