Don't delete the site or restore a random backup. Change your passwords from a clean device, download a copy of the site as it is, and send us the domain: Armor SOS checks hacked sites for free the same working day, Monday to Friday, 08:00–17:00, and quotes any cleanup before work starts.
Common signs: Google or the browser warns “Dangerous site”, search results show pages you never wrote (gambling, pharmacy, loans), visitors on phones get redirected, you find admin users or files you didn’t create, or your email starts bouncing. Attackers often hide the damage from logged-in owners, so if a customer reports it, believe them.
Do this in the next ten minutes
- Don’t delete the site or restore a random backup. The backup may already contain the backdoor, and deleting things destroys the evidence of how they got in.
- Change passwords from a clean device. Start with the client area and cPanel, then every WordPress administrator, FTP accounts, the database user and email. If your own computer may be infected, use another one.
- Download a copy of the site as it is. Files and database, from cPanel’s Files → Backup page. Whoever cleans it works from this, and you have something if anything goes wrong.
- Send us the domain and what you see. A screenshot of the warning or the strange page helps. Use Armor SOS or WhatsApp. Outside office hours, open a ticket marked urgent.
What Armor SOS does
Triage is free, the same working day: we confirm whether the site is hacked, find what was changed and check Google Safe Browsing and the main blacklists. You get a written finding and a cleanup quote before any paid work starts. After you accept, we remove the malicious files, injected pages, rogue users and backdoors, close the way in, and ask Google and the blacklists to review the site. It works whoever hosts your site. On managed WordPress, malware removal is already part of your plan: just open a ticket.
Checks you can make yourself
- Users: in wp-admin, open Users and note any administrator you don’t recognise.
- Plugins and themes: look for ones you didn’t install, and for “nulled” (pirated) premium plugins, a common way in.
- Server scan: see what Imunify360 has found: How do I scan my website for malware in cPanel?
- Google: search
site:yourdomain.comfor pages you didn’t write.
Tip: Cleaning without closing the way in is how sites get reinfected within a week. Afterwards, keep everything updated (How do I update WordPress safely?) and put a firewall in front of the site, such as Armor Guard at $9 a month.
If customers’ or staff personal information was exposed, Zimbabwe’s Cyber and Data Protection Act requires the data controller to notify POTRAZ within 24 hours of becoming aware of the breach. We help you document what happened, but this isn’t legal advice.
Send the domain on WhatsApp and we’ll start the triage.
Updated 6 November 2026. Something here out of date? Tell us.