If you are wondering what to do after a website is hacked, focus on a careful sequence: contain the immediate risk, preserve evidence, secure every route into the site, and restore only after you have addressed the cause. A changed homepage or suspicious redirect is a warning, but it does not by itself show whether customer or employee information was accessed.
For a Flagler County business, the website may depend on accounts that are easy to overlook, including hosting, domain registration, DNS, business email, backups, and outside vendors. Use the steps below as a first-day response checklist. If sensitive information or essential business operations may be involved, bring in qualified incident-response and legal professionals early.
Start by containing the problem
Contact the person or provider responsible for managing the website, hosting, or security. Tell them what you observed and when. If you have an IT provider, alert them as well. Use a phone number or contact method you already trust rather than a link in an unexpected message about the incident.
Ask the site administrator or hosting provider whether the site should be temporarily placed in maintenance mode, restricted, or taken offline. A public page that is actively redirecting visitors or serving harmful content may need to be limited while it is investigated. The right choice depends on what is happening and how the site is hosted, so avoid making a rushed change that could erase useful information or affect other business systems.
- Record what visitors see, including suspicious redirects, messages, or changed pages. Take screenshots if you can do so safely.
- Write down when the issue was first noticed, who found it, and what actions have already been taken.
- Do not delete suspicious files, wipe the server, or reinstall the site before relevant logs and evidence have been preserved.
- If the site handles payments, customer accounts, or sensitive information, tell the appropriate internal owner and get professional guidance promptly.
Keep communication factual. Avoid declaring publicly that customer data was or was not exposed until an investigation supports that conclusion.
Preserve evidence before cleaning up
Ask the hosting provider or technical administrator to preserve available server, website, and security logs. Depending on the setup, useful records may also include CMS activity, administrator sign-ins, DNS changes, firewall or content-delivery records, backup history, and alerts from security tools. Availability varies by provider, so request preservation promptly.
Save relevant notices from hosting, domain, email, and security providers. Keep copies of suspicious messages and record the names of people who made changes, along with when they made them. Store these notes and files somewhere that is not controlled by a potentially compromised website account.
Preserving evidence is not about conducting a full forensic investigation yourself. It helps qualified responders understand what happened and can prevent well-intended cleanup from removing clues. For broader preparation around business data, see Flagler County data protection considerations.
Secure every account that could provide access
Changing the website administrator password alone may leave other ways for an intruder to return. From a device you believe is safe, work with your IT or incident-response provider to review the accounts and connections tied to the site.
- Business email: Secure the email accounts used for site administration and password resets. Review recovery details, forwarding rules, and active sessions.
- Hosting and server access: Change credentials, review administrator accounts and access keys, and remove access that is not recognized or authorized.
- Domain registrar and DNS: Check for unexpected users, changed contact information, or unfamiliar changes to where the domain points.
- Website platform: Review CMS administrators, application passwords, API keys, plugins, themes, and connected integrations. Remove unknown access only after documenting it.
- Backups and cloud services: Protect the accounts that store website backups and check who can access or alter them.
- Vendors and payment tools: Ask relevant providers to review their access and activity, especially if they connect to the website or handle customer transactions.
Use unique replacement passwords and multifactor authentication where available. Revoke active sessions or access tokens when the responsible provider recommends it. If an account may be controlled by an attacker, do not rely on that account to coordinate recovery.
Find out what may have been exposed
A defaced homepage does not prove that personal information was taken, and a normal-looking page does not prove that the site is clean. Ask the technical responders to review logs and other available evidence for unauthorized access, changes, downloads, or activity involving forms, customer accounts, payment tools, and connected databases.
Make a practical inventory of the kinds of information the website could store or transmit. This may include contact details, account credentials, payment-related information, or information submitted through forms. The exact data and systems involved matter when deciding what to do next.
If the incident may involve confidential personal information, regulated records, or a third-party service, involve legal counsel and appropriate incident-response professionals. Florida law generally requires notice to affected individuals as expeditiously as practicable and no later than 30 days after determining that a breach occurred or there is reason to believe one occurred; it also generally requires a covered entity to notify the Florida Department of Legal Affairs within 30 days when a breach affects 500 or more individuals in the state. Review the Florida statute and get advice about how its requirements apply to the incident and your organization.
Businesses can also review the FBI Internet Crime Complaint Center’s data breach reporting information to understand the reporting channel. Reporting does not replace investigating the incident or addressing any notification duties that may apply.
Restore only after the cause is addressed
A clean backup can help bring a website back, but restoring too soon can reintroduce compromised files or leave the entry point open. Before recovery, ask the technical team to identify and address the likely cause, remove unauthorized access, and update or replace affected software and components.
Choose a backup that has been checked for signs of compromise. Where practical, test the restored site in a controlled environment before making it public. After it is restored, verify that key pages, forms, and integrations work as expected, and keep monitoring for suspicious activity.
Ask for a vulnerability review after the immediate response. CISA describes vulnerability scanning as a way to identify exploitable weaknesses that may need attention. Read CISA’s vulnerability scanning fact sheet. A scan can help find weaknesses, but it is not a substitute for checking whether an attacker still has access or investigating what happened.
For a wider look at ongoing protection, you can also review cybersecurity considerations for Flagler County businesses.
Frequently asked questions
Should I take my website offline after a hack?
Not automatically. If it is actively redirecting visitors or exposing harmful content, restricting access may reduce risk. Ask your site administrator or provider to help decide, and preserve available evidence before making changes when possible.
Which passwords and accounts should I reset?
Review business email, hosting, the domain registrar, DNS, CMS administrators, cloud backups, connected services, and vendor accounts, not just the website login. Use a safe device and coordinate changes with the people handling the response.
How can I tell whether customer information was exposed?
Do not infer exposure from the appearance of the website. Have qualified responders review available logs and affected systems, including forms, databases, customer accounts, and payment integrations. If sensitive information may be involved, consult legal counsel promptly.
When should I restore from a backup?
After evidence has been preserved, the backup has been checked, and the likely entry point and unauthorized access have been addressed. Restoring without fixing the underlying weakness can leave the site vulnerable to another compromise.
Make the next step a coordinated one
A website incident can involve more than the site itself. Contain the immediate risk, keep records, secure connected accounts, assess possible data exposure, and verify the recovery before treating the incident as resolved. If your Flagler County business needs help reviewing its website security or broader IT environment, contact Zevonix at (386) 260-0777 to discuss the situation and appropriate next steps.