Step 1: Contain it (first 15 minutes)

1. Open a support ticket with us right away — say the site appears hacked and describe what you see. We can check the account from the server side.
2. Change the passwords — from a clean device: client area, cPanel, WordPress admin, FTP, and your main email. The attacker may hold any of them.
3. Note the signs — unknown admin users, new files or posts you didn't create, redirects, spam complaints. Write down when you first noticed; it helps locate the entry point and the last clean moment.

Step 2: Clean it

1. The reliable route — restore a clean backup: restore the most recent backup from BEFORE the hack (see the backup/restore guides). A backup taken after the infection just restores the infection.
2. No clean backup? For WordPress: reinstall WordPress core, themes and plugins fresh from their original sources, remove unknown admin users, and scan with a security plugin. Uploads folders deserve special suspicion — they should hold media, never code.
3. Delete anything you don't recognize: unknown PHP files in the site folders, unknown scheduled tasks in Cron Jobs, unknown FTP accounts.
4. Update everything the moment the clean site is up — the hole they came through is usually a known, already-fixed bug.

Step 3: Recover your reputation

1. If Google flagged the site: after cleaning, request a review in Google Search Console — the warning is removed once the site passes.
2. If your email was blacklisted for spam sent by the hack: fix the hack first, confirm SPF/DKIM/DMARC are valid (Email category), then request delisting — listings return while spam still flows.