In this guide · 8 sections
Short answer
Take the site offline or into maintenance mode, change every admin, hosting and database password, and keep a copy of the hacked files. Then restore a clean backup, update everything, and request a review in Google Search Console. If customer data may be exposed, start the PDPA breach assessment at once.
Signs your website has been hacked
Common symptoms, according to Google's guide to hacked sites and CSA's website advisory:
- The home page or other pages show content you did not put there (defacement).
- Google results for your site show spam pages, foreign-language text or pharmacy terms.
- Visitors from Google or mobile are redirected to another site, while you see the normal site.
- Chrome or Search Console shows a 'deceptive site' or malware warning.
- Unknown admin users, new files, or your host suspending the account for sending spam.
What to do in the first hour
Work through these in order. If someone else built or hosts your site, call them now, but do not wait for them to start step 1.
Put the site into maintenance mode or take it offline
This stops visitors being redirected or infected. Most hosts and website builders let you do this from the control panel.
Copy the site and the logs
Download the files, export the database and save the hosting access logs. This is your evidence for what happened and when.
Change every password
Hosting control panel, website admin accounts, FTP or SFTP, the database user, and the email account that receives password resets. Use new, unique passwords and turn on two-factor authentication.
Remove unknown admin users
Check the website's user list and the hosting account for accounts you do not recognise, and remove them.
Check whether customer data could be involved
Contact forms, bookings, an online store or a member area mean personal data may be on the server. Note this now for the PDPA step below.
Get help to triage if you need it
The CSA Cyber Incident Helpline gives triage and containment advice; see our Cyber Incident Helpline guide.
Clean up and restore a clean copy
The safest fix is to restore from a backup taken before the hack, then update. To pick the right backup, look at the dates of changed files and suspicious log entries in the copy you saved.
- WordPress: restore files and database from a clean backup, then update WordPress core, every plugin and theme. Delete plugins and themes you do not use. Reinstall plugins from the official source rather than trusting old files. If an update caused problems, our WordPress update fix guide helps.
- Website builders (Wix, Squarespace, Shopify): the platform runs the servers, so the usual cause is a stolen login or a third-party app. Change passwords, turn on 2FA, remove unknown staff accounts and review installed apps and custom code snippets.
- Custom code: rebuild from your code repository onto a fresh server rather than cleaning the old one, and rotate every API key and secret the site used.
If there is no clean backup, cleaning by hand is possible but slow, and it is easy to miss a hidden back door. This is the point where paying a professional is usually cheaper.
Close the hole: find how attackers got in
If you restore without fixing the cause, it will happen again. CSA's advisory on protecting your website from cyber-attacks (updated 6 April 2026) lists the usual ways in: unpatched software, weak or default passwords, and old files left on the server. Its Singapore Cyber Landscape report adds that most defaced Singapore sites in 2025 belonged to SMEs, with legacy setup or configuration files giving attackers access.
Hardening checklist (from CSA's advisory)
Get Google to remove the warning
If Google flagged your site, warnings appear in the Security Issues report in Google Search Console. Once every listed issue is fixed on every page, select Request Review and explain what was wrong and what you fixed. Google says a security review can take from a few days to a few weeks, and asks you not to resubmit while a request is pending.
If spam pages were indexed, return a 404 or 410 for them and use the Removals tool in Search Console for urgent cases. Rankings usually recover once the site is clean and Google recrawls it.
Report it: SingCERT, police and the PDPA
- SingCERT (CSA): report the incident through CSA's Cyber Aid form or email singcert@csa.gov.sg, as listed on the SingCERT page.
- Police: website defacement and hacking are offences. The SPF describes defacement as gaining unauthorised access to a website's server or content system to alter it. File a police report if you need one for insurance or legal reasons.
- PDPC: if personal data may have been accessed, you must assess whether it is a notifiable breach. A breach is notifiable if it is likely to cause significant harm or affects 500 or more people, and you must then notify the PDPC within 3 calendar days of that assessment. Our PDPA breach notification guide explains the steps.
This page is practical guidance, not legal advice. If a large amount of customer data is involved, get professional advice early.
Do it yourself or get help?
A site with a recent clean backup, no customer data and a known cause (an outdated plugin, say) can be restored by a confident owner in an afternoon. A site with an online store, no backup, or repeat infections is a job for someone who does this regularly.
Our Website Security Hardening (S$290) cleans up access, updates, removes old files and sets up a firewall and monitoring. Backup & Ransomware Recovery (S$290) sets up offline backups you can restore from, and Care Plus (S$349 a month) keeps the site updated and watched. Our website maintenance cost guide compares the options.
Frequently asked questions
Common signs are pages you did not create, spam or foreign-language results for your site in Google, visitors being redirected elsewhere, a 'deceptive site' or malware warning in Chrome, unknown admin users, or your host suspending the account. Google Search Console's Security Issues report will also list problems Google has detected.
Yes, usually. Putting the site into maintenance mode stops visitors from being redirected or infected while you investigate. Save a copy of the files, database and logs first so you have evidence, then change all passwords and restore from a clean backup before bringing the site back online.
After you fix every issue and select Request Review in Search Console's Security Issues report, Google says a security review can take from a few days to a few weeks. You will be told by email. Do not resubmit while a request is pending, as that can slow things down.
You can report it to SingCERT through CSA's Cyber Aid form or by email, and to the police if you need a report. If personal data may have been accessed, you must assess the breach under the PDPA, and notify the PDPC within 3 calendar days if it is notifiable.
Find and fix the cause, not just the symptoms. Keep the software, plugins and themes updated, remove old and unused files, use strong unique passwords with two-factor authentication, add a web application firewall, set up monitoring and keep offline backups. CSA's website advisory lists these measures.