Website hacked? Recognize the signs and respond correctly

A hacked website can often be identified by new or modified files, unknown user accounts, redirects to external sites, or spam pages in Google results. If you suspect an attack, you should act in this order: secure evidence, take the website offline, change access credentials, identify and close the cause, and restore the site cleanly. If personal data is affected, the data protection authority must usually be informed within 72 hours.

After critical vulnerabilities such as PHP2Shell attackers try to compromise unpatched servers on a mass, automated basis. In the process, they often create a so-called Webshell from: a small file through which they can later remotely control the server – even after an update.

Signs of an attack

• New or recently modified PHP files that no one created, especially in upload or cache folders.
• Unknown administrators or users in the CMS.
• Redirects to advertising, casino, or pharmaceutical sites, often only for visitors from Google or on mobile devices.
• Foreign pages in Google results under your domain (search "site:your-domain.de").
• Warnings from Google, your hosting provider, or your browser.
• Frequent error messages or crashes, suddenly high server load.
• On the server: shells, download tools such as curl or wget, or other processes started by the web server.

For PHP2Shell, the BSI cites exactly such general indicators: suspicious processes of the web server, new or modified PHP files and possible web shells, as well as conspicuous upload requests in the logs, followed by memory errors or repeated errors with code 500.

What you should do immediately

1. Stay calm and document: What was noticed, when, and by whom?
2. Preserve evidence: Secure log files and a copy of the files before anything is deleted. They will be needed to identify the cause.
3. Take the website offline or put it into maintenance mode so no further damage occurs.
4. Change all access credentials: CMS administrators, hosting, FTP/SFTP, database, email. Best done from a clean device.
5. Find and close the cause: outdated PHP, plugin, or theme? Without fixing it, the attacker will come back.
6. Restore cleanly: from a backup made before the attack, then install all updates. Simply deleting malicious code is rarely enough.
7. Monitor: Keep an eye on logs and files in the weeks that follow.

Reporting obligation under the GDPR

If attackers may have accessed personal data — for example customer data in the shop, contact forms or job applications — there may be a data breach. Under Art. 33 GDPR it must be reported without undue delay and, where possible, within 72 hours to the competent supervisory authority, unless it is unlikely to result in a risk to the data subjects. Involve your data protection officer at an early stage. This article does not replace legal advice.

Prevention is cheaper

Most attacks on SME websites exploit known vulnerabilities in outdated software. Regular updates, separate backups, and a few well-protected access points prevent the majority of incidents. The most important measures are outlined in Website security for SMEs: 10 measures.

Unsure whether your website, online shop, or devices are affected? Get in touch with us. We check your systems, install updates and tell you honestly what needs to be done – even if it turns out that everything is fine. To start, a brief conversation.

Frequently asked questions

How can I tell that my website has been hacked?

By unknown files or users, redirects to external pages, spam pages in Google results, warnings from Google or the hosting provider, and unusual processes on the server.

Is it enough to delete the malicious code?

Rarely. Attackers often leave multiple backdoors behind. It is safer to restore from a clean backup, close the underlying vulnerability, and change all access credentials.

Do I have to report a hacker attack?

If personal data may be affected, usually yes: to the competent data protection supervisory authority, without undue delay and, where possible, within 72 hours of becoming aware of it (Art. 33 GDPR). In the case of criminal offences, filing a report with the police may also be advisable.

Status: October 2026. No legal advice. Source indicators: BSI security advisory on PHP2Shell.