{"id":77022,"date":"2026-07-13T16:09:07","date_gmt":"2026-07-13T14:09:07","guid":{"rendered":"https:\/\/tremhost.com\/blog\/?p=77022"},"modified":"2026-07-13T16:09:07","modified_gmt":"2026-07-13T14:09:07","slug":"my-website-is-under-attack-right-now-what-do-i-do-in-the-next-10-minutes","status":"publish","type":"post","link":"https:\/\/tremhost.com\/blog\/my-website-is-under-attack-right-now-what-do-i-do-in-the-next-10-minutes\/","title":{"rendered":"My Website Is Under Attack Right Now \u2014 What Do I Do in the Next 10 Minutes?"},"content":{"rendered":"<p class=\"font-claude-response-body break-words whitespace-normal\">If you&#8217;re reading this while refreshing your analytics dashboard in a cold sweat, watching traffic spike into nonsense, or staring at a defaced homepage stop scrolling for a solution and start with these steps. This isn&#8217;t a theory piece. It&#8217;s what to actually do, in order, right now.<\/p>\n<p><a href=\"https:\/\/tremhost.com\/clientarea\/store\/tremhost-armor-powered-by-cloudflare\">https:\/\/tremhost.com\/clientarea\/store\/tremhost-armor-powered-by-cloudflare<\/a><\/p>\n<h3 class=\"text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold\">Minute 0\u20132: Confirm What You&#8217;re Actually Dealing With<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal\">Before reacting, figure out which of these you&#8217;re facing, because the response is different for each:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>DDoS attack<\/strong> \u2014 site is slow or completely unreachable, server load is spiking, traffic is coming from unusual geographic patterns or looks automated<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Brute-force \/ login attack<\/strong> \u2014 spike in failed login attempts, unusual admin activity, or you&#8217;ve been locked out of your own dashboard<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Site defacement or malware injection<\/strong> \u2014 visible changes to your homepage, unexpected redirects, browser security warnings, or Google flagging your site<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Data breach<\/strong> \u2014 unauthorized access to customer data, database, or payment information<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal\">Check your hosting control panel or server logs if you can still access them. If you can&#8217;t access anything, that&#8217;s information too move to the next step.<\/p>\n<h3 class=\"text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold\">Minute 2\u20135: Stop the Bleeding, Don&#8217;t Chase the Cause<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal\">The instinct under pressure is to start investigating <em>why<\/em> this happened. Resist that for now. Root-cause analysis is a job for after the site is stable \u2014 right now the priority is containment.<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Do not<\/strong> start deleting files, plugins, or database entries without a backup. You can destroy your own evidence and your recovery path in the same click.<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Do<\/strong> take a screenshot or note of anything visibly wrong \u2014 timestamps matter for later.<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Do<\/strong> change your hosting\/admin\/database passwords immediately if you still have access, using a device you trust.<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\"><strong>Do not<\/strong> post publicly about the attack yet \u2014 attackers sometimes monitor public reaction to gauge success.<\/li>\n<\/ul>\n<h3 class=\"text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold\">Minute 5\u20138: Get Traffic Behind a Shield<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal\">If your site is reachable but struggling, the fastest lever available is putting traffic through a filtering layer before it reaches your origin server this is what Cloudflare&#8217;s <strong>Under Attack Mode<\/strong> does. It forces every visitor through a browser check before your server ever sees the request, which buys you breathing room without touching your actual site files.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">If your DNS is already proxied through Cloudflare, this can be flipped on in minutes. If it isn&#8217;t if your site&#8217;s real server IP is exposed to the internet this is the part that takes longer to do safely yourself, because DNS changes can take hours to propagate if they&#8217;re not configured correctly beforehand.<\/p>\n<h3 class=\"text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold\">Minute 8\u201310: Decide If You Need Emergency Help vs. DIY<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal\">Here&#8217;s the honest fork in the road:<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>You can likely handle this yourself if:<\/strong> you already have Cloudflare or a similar proxy in front of your site, you have recent clean backups, and the issue is a traffic spike rather than a breach.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>You need emergency intervention if:<\/strong> your origin server IP is exposed, you don&#8217;t have DNS\/WAF protection in place yet, you suspect actual compromise (not just traffic overload), or every minute of downtime is costing you sales, bookings, or reputation.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">This is the exact gap<a href=\"http:\/\/Tremhost Armor SOS\" rel=\"nofollow\"> <strong>Tremhost Armor SOS<\/strong><\/a> exists to close.<\/p>\n<h3 class=\"text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold\">What Armor SOS Actually Does in This Situation<\/h3>\n<div class=\"overflow-x-auto w-full px-2 mb-6\">\n<table class=\"min-w-full border-collapse text-sm leading-[1.7] whitespace-normal\">\n<thead class=\"text-left\">\n<tr>\n<th class=\"text-text-100 border-b-0.5 border-[hsl(var(--border-300)\/0.6)] py-2 pr-4 align-top font-bold\" scope=\"col\">Step<\/th>\n<th class=\"text-text-100 border-b-0.5 border-[hsl(var(--border-300)\/0.6)] py-2 pr-4 align-top font-bold\" scope=\"col\">What Happens<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td class=\"border-b-0.5 border-[hsl(var(--border-300)\/0.3)] py-2 pr-4 align-top\">Emergency DNS cutover to Cloudflare<\/td>\n<td class=\"border-b-0.5 border-[hsl(var(--border-300)\/0.3)] py-2 pr-4 align-top\">Same-day \u2014 your traffic gets routed through protection without waiting on a standard migration timeline<\/td>\n<\/tr>\n<tr>\n<td class=\"border-b-0.5 border-[hsl(var(--border-300)\/0.3)] py-2 pr-4 align-top\">Under Attack Mode activation<\/td>\n<td class=\"border-b-0.5 border-[hsl(var(--border-300)\/0.3)] py-2 pr-4 align-top\">Every visitor is challenged before reaching your origin, immediately reducing attack traffic hitting your server<\/td>\n<\/tr>\n<tr>\n<td class=\"border-b-0.5 border-[hsl(var(--border-300)\/0.3)] py-2 pr-4 align-top\">Emergency WAF and rate-limiting rules<\/td>\n<td class=\"border-b-0.5 border-[hsl(var(--border-300)\/0.3)] py-2 pr-4 align-top\">Custom rules deployed specifically for what&#8217;s happening to your site, not generic defaults<\/td>\n<\/tr>\n<tr>\n<td class=\"border-b-0.5 border-[hsl(var(--border-300)\/0.3)] py-2 pr-4 align-top\">Origin IP rotation<\/td>\n<td class=\"border-b-0.5 border-[hsl(var(--border-300)\/0.3)] py-2 pr-4 align-top\">If your real server IP has been exposed or targeted, it&#8217;s changed so attackers lose their direct line to your server<\/td>\n<\/tr>\n<tr>\n<td class=\"border-b-0.5 border-[hsl(var(--border-300)\/0.3)] py-2 pr-4 align-top\">Post-incident summary<\/td>\n<td class=\"border-b-0.5 border-[hsl(var(--border-300)\/0.3)] py-2 pr-4 align-top\">A clear written record of what happened and what was changed \u2014 useful for your own records, your customers, or compliance requirements<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p class=\"font-claude-response-body break-words whitespace-normal\"><strong>Cost:<\/strong> $150.00, one-time, for the emergency response.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\">Unlike the standard onboarding for Armor Lite or Armor Pro which are built for sites that want protection <em>before<\/em> something goes wrong SOS is built for exactly this moment: you&#8217;re already in it, and you need someone to act now, not schedule a consultation for next Tuesday.<\/p>\n<h3 class=\"text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold\">After the Fire Is Out<\/h3>\n<p class=\"font-claude-response-body break-words whitespace-normal\">Once your site is stable, that&#8217;s when root-cause work matters reviewing how the attacker got in, what vulnerability was exploited, and what ongoing protection should look like. Most businesses that go through an emergency response move to <strong>Armor Lite or Armor Pro<\/strong> afterward, specifically so this doesn&#8217;t happen a second time. That&#8217;s a separate conversation for a calmer day right now, the job is just getting your site back under control.<\/p>\n<p><a href=\"https:\/\/tremhost.com\/clientarea\/store\/tremhost-armor-powered-by-cloudflare\">https:\/\/tremhost.com\/clientarea\/store\/tremhost-armor-powered-by-cloudflare<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you&#8217;re reading this while refreshing your analytics dashboard in a cold sweat, watching traffic spike into nonsense, or staring at a defaced homepage stop scrolling for a solution and start with these steps. This isn&#8217;t a theory piece. It&#8217;s what to actually do, in order, right now. https:\/\/tremhost.com\/clientarea\/store\/tremhost-armor-powered-by-cloudflare Minute 0\u20132: Confirm What You&#8217;re Actually [&hellip;]<\/p>\n","protected":false},"author":226,"featured_media":33218,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[365],"tags":[],"class_list":["post-77022","post","type-post","status-publish","format-standard","has-post-thumbnail","category-tremhost-academy"],"_links":{"self":[{"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/posts\/77022","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/users\/226"}],"replies":[{"embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/comments?post=77022"}],"version-history":[{"count":1,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/posts\/77022\/revisions"}],"predecessor-version":[{"id":77023,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/posts\/77022\/revisions\/77023"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/media\/33218"}],"wp:attachment":[{"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/media?parent=77022"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/categories?post=77022"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/tags?post=77022"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}