Hacked? Your First 24 Hours: A Calm Incident Response Plan

Discovering your site is hacked triggers two instincts, both wrong: delete everything suspicious immediately, or quietly hope nobody notices. The first destroys the evidence you need; the second turns a bad day into a legal problem. Here's the calm version.

Hour 1: Contain

• Take the site into maintenance mode if customer data or payments could be exposed. Ten minutes of downtime is cheaper than one more compromised customer.
• Rotate credentials from a clean device — admin, hosting, database, FTP. Assume the attacker has whatever passwords the site knew. Use a machine that hasn't logged into the site recently, in case a staff device is the source.
• Don't delete anything yet. You'll want the evidence intact — for finding the entry point, and possibly for insurers or authorities.

Hours 2–4: Assess

• Snapshot everything — a full copy of files and database in their compromised state.
• Establish the timeline. File modification dates and access logs usually reveal when the compromise started — which tells you which backups are clean.
• Determine what data was reachable. Customer names? Emails? Card data (hopefully your processor held that)? The answer drives your legal obligations.

Hours 4–12: Clean and rebuild

• Restore from a backup that predates the compromise — the timeline you built tells you which one. Restoring last night's backup restores last night's backdoor.
• Patch before going live. Update everything, remove unused plugins and accounts. Going live unpatched invites the same attacker back through the same door.
• Scan the restored site to verify it's actually clean — infections have a way of living in places restores don't touch.

Hours 12–24: Communicate

If customer data was exposed, notification isn't optional — most jurisdictions require it. Beyond the legal duty, honest disclosure handled quickly consistently damages trust less than a cover-up discovered later. Short, factual, human: what happened, what you've done, what customers should do.

Write this plan down today

Every step above is harder to think of at 2am with your store down. One printed page — contacts, backup locations, the sequence — turns panic into procedure.

Better still is finding out on day zero: Trust Guard's daily scans typically surface compromises before customers or Google ever see them, which makes the whole 24-hour plan a quieter affair.