← Back to Blog

A hacked website rarely announces itself politely. You find out because a customer says your site redirected them somewhere strange, Google shows a warning, your host suspends the account, or your own pages are suddenly selling something that is not yours. The first hours matter, mainly because the common instinct, deleting the odd file and hoping, destroys the evidence you need and often leaves the way in open.

This is a practical order of operations for a business owner, drawn from official incident guidance from CISA and the UK NCSC, Google's own process for hacked sites, and the reporting channels the UAE government lists. Where we are adding our own experience, we say so.

Before you start: what these sources are, and are not

CISA's and NCSC's guidance is written for organisations dealing with cyber incidents generally, and CISA's most detailed pages are about ransomware. A defaced or spam-injected website is a different incident, but the discipline is the same: isolate, preserve, clean, restore, close the hole, tell the right people. We use it that way.

Hours 0 to 2: contain it

CISA's first instruction is short: determine which systems were impacted, and immediately isolate them. For a website, that means stopping it from doing further harm while you work.

Hours 1 to 3: preserve evidence

CISA tells responders to preserve evidence that is highly volatile in nature, or limited in retention, and to collect relevant logs. On a hosted website, translate that as:

  1. Ask your host to snapshot the account as it stands, files and database, before cleanup, and to keep the access and error logs. Many hosts rotate logs within days.
  2. Take screenshots of what visitors see, with the time and your timezone, and note when you first noticed it.
  3. Write down what changed recently: plugin or theme updates, new users, a developer given access, a core update. We suggest it because the answer often points straight at the way in.

This copy is for the investigation and for any report, insurer or police complaint. It is not your restore point. It is infected.

Hours 2 to 6: change credentials, in the right order

Changing passwords is necessary, and the order matters. CISA's guidance says to issue password resets for affected systems once the environment has been fully cleaned and rebuilt. An attacker who still has a foothold can simply read your new passwords as you set them. In practice we do it in two passes:

Our website security guide for UAE businesses explains why accounts come before plugins on the list of things to lock.

Hours 6 to 18: restore from a clean backup and find the way in

NCSC's small business guide lists restoring services through backups among the actions to take, alongside changing passwords. CISA adds a caution: take care not to re-infect clean systems during recovery. Both lead to the same rules:

Not sure a backup exists? Ask your host today, in writing. If the answer is no, the honest path is a rebuild from your content, and it is a good moment to ask whether WordPress is still the right base for the business.

Hours 12 to 24: Google, and who else to tell

Google

If your site was hacked, check Search Console. Its Security Issues report covers hacked content, malware and social engineering. Hacked content is defined as any content placed on your site without your permission because of security vulnerabilities in your site, with examples such as spammy links injected into pages, or new pages created by the attacker.

Once clean, Google's instruction is: when all issues listed in the report are fixed in all pages, select Request Review. Describe the exact issue and the steps you took. Reviews can take several days or weeks, and you should not resubmit while one is pending. Request it only when the site is genuinely clean.

The UAE channels

The UAE Cyber Security Council's report an incident page and the government portal's cyber safety page list where to go:

Extortion, stolen money, impersonation or stolen customer data are police matters. Keep the preserved evidence for the complaint.

If customer data was involved

The UAE's federal Personal Data Protection Law, in force since 2 January 2022 according to the government portal, includes a breach-reporting provision. As we read Article 9, a controller that becomes aware of a breach that would prejudice the privacy, confidentiality or security of personal data must notify the regulator, and affected individuals in some cases, within periods and by methods that the law leaves to its executive regulations. We could not find those executive regulations on an official government site, so we cannot give you a deadline. Businesses in DIFC and ADGM are under their own data protection laws.

CISA's guidance says the same thing in plain language: if the incident resulted in a data breach, follow notification requirements in your response plan. Treat the question of whether your site holds personal data, such as orders, enquiry forms or accounts, as one to answer in the first 24 hours, and ask a lawyer who handles UAE data protection law before deciding.

This is general information, not legal advice.

A message you can send your host

Our website [your domain] was compromised on or about [date and time, timezone]. Please: (1) snapshot the account, files and database, exactly as they are now, and preserve the access, error and FTP/SSH logs; (2) tell me the PHP version and the dates of your last backups; (3) confirm which accounts have had access in the last 30 days; (4) confirm in writing when the site can be restored from a backup that predates the compromise.

After the first day

Keep watching for a week: new admin users, changed files, strange outbound mail, a return of Google warnings. Then fix the cause that let it happen. Write down who owns updates, hosting and backups, and test a restore. We cover the wider checklist in our UAE website security guide.

If you are in the middle of an incident and want a second pair of hands on cleanup and the rebuild, tell us what happened. For WordPress sites we can take ownership of updates and hosting through our WordPress service, and for businesses that want to leave the plugin treadmill entirely, our custom website build is the other route.

Guidance is as published by CISA, the UK NCSC, Google, the UAE Cyber Security Council and the UAE government portal on or before 13 November 2026. Check each for later changes.