When You Find Your Site Has Been Hacked: What to Do, and Not Do, in the First 24 Hours

When people find their site has been hacked, the first impulse is to delete the suspicious files and call it fixed. That’s understandable, but it leaves the way in open and wipes out the evidence of what happened. According to Google’s developer guide, about 20% of hacked sites are hacked again within a day (web.dev). Fix the site without closing the way in, and the attacker simply comes back.

This article walks through what to do first, in order, after you notice. It is the third of four articles on website security basics. The legal points follow the pages of Japan’s Personal Information Protection Commission (PPC) as of November 8, 2026.

Stop it, then preserve it

First, stop the damage from spreading. Switch the site to a maintenance page or restrict access. If visitors are being redirected elsewhere, take the site offline, and if there are payments or forms, consider suspending them. Taking the site down costs sales, but if card numbers or personal data are being stolen every time someone types them in, there is no reason to keep it up. If you can’t decide, at least stop payments and forms.

Once it’s stopped, copy the current state before fixing anything: the full set of site files, the database, and the access logs, error logs and admin login records. Google’s guide also says to back up files and the database before making changes (web.dev). Shared hosting may delete old logs automatically, so get them on day one.

Change every password, and tell people

Next, change every password and key. The CMS admin alone isn’t enough. That means the server control panel, FTP or SFTP and SSH, the database, every CMS admin, the email accounts the site sends from, and the API keys for payments and other outside services. Do this from a separate computer you know is clean. If the password was stolen from the staff member’s own computer, changing it on that same machine gets it stolen again.

And don’t try to handle it alone. Tell your hosting company, your developer or maintenance company, your payment processor if you take payments, and the person responsible inside your company.

Close the way in, then fix

Fix the site only after you’ve found and closed the way in. Any outdated CMS, plugin or PHP version is a likely candidate. Look for admins or plugins you don’t recognize too. Then restore from a clean backup taken before the compromise, bring everything up to date, and reinstall core, plugins and themes from official sources. As clues for spotting malicious PHP files, Google’s guide points to recent modification dates, unfamiliar names, and functions that hide what the code does, such as base64_decode, eval and gzinflate (web.dev).

Once it’s fixed, request a review from Google through Search Console’s Security issues report. Describe what happened, what you did and the result; the review takes several days to several weeks. Fixing only some pages won’t remove the warning, so fix the whole site before you ask. Resubmitting during a review backfires too, since requesting too early can delay the next review (Search Console Help).

It’s worth spelling out what happens when this order is broken. Delete the suspicious files and stop there, and the way in stays open. Wipe the server first and then try to find the cause, and there’s nothing left to examine. Restore a backup without closing the way in, and the attacker walks back in through the same door.

When personal data may have leaked

Under Japan’s Act on the Protection of Personal Information, a leak or suspected leak must be reported to the PPC when it falls into certain categories: when it involves sensitive personal information such as medical history, when there is a risk of financial harm as with credit card numbers, when there may be a wrongful purpose, and when more than 1,000 people are affected (PPC).

If a site compromise may have leaked personal data, it will often fall under the wrongful-purpose category. The PPC’s page gives examples including leaks through unauthorized access and personal data typed into a tampered site being sent to a third party, and this category has no minimum number of people.

There are deadlines. The preliminary report is due within 3 to 5 days of learning of the leak, and the final report within 30 days, or 60 days where a wrongful purpose may be involved (PPC). Reports generally go through the PPC’s online form, and the affected individuals must also be notified (Article 26, Paragraph 2 of the Act; General Guidelines).

A review of the related cabinet orders and rules following amendments to the Act is under way (PPC secretariat material dated October 1, 2026). When you actually file, check the PPC’s page for the current rules, and consult a lawyer if you’re unsure.

Where to get help in Japan

There are three public places to turn. IPA’s consultation desk for companies and organizations gives advice on first response and emergency measures, introduces specialist firms and points you to other contacts. It takes inquiries by email only and doesn’t investigate or analyze anything itself, so for a log investigation you’ll need a specialist company (IPA).

JPCERT/CC’s incident reporting accepts requests such as help with a tampered site, by web form or email, and contacts and coordinates with the source of the attack. A formal damage report goes to your local police station, but the police cyber incident desk also accepts reports and consultations online.

Before it happens

How long all this takes depends heavily on preparation. Keep backups somewhere other than the server and test restoring one at least once. Find out where your logs are and how many days they cover (how to check is in the second article, on the monitoring that helps you notice a hack). Put the contacts for your hosting company, developer and payment processor on one page, and decide who has the authority to take the site down. That alone changes how the first 24 hours go.

What management should decide in advance is covered in our article on zero trust and security in the AI era. If you’ve found a compromise or suspect one, contact us.