Confirm and contain
First confirm the problem by looking at the site in a private window and by searching your domain in a search engine for unusual page titles. Contact your host right away; they may have scan reports and can suspend or isolate the account. If customers could be affected, consider putting up a maintenance page while you work.
Do not delete everything in a hurry. You need evidence of what happened and a copy of the site for the cleanup.
Change every credential
From a clean computer, change passwords for hosting, the website admin, FTP or SSH, the database, your domain registrar and the email address tied to those accounts. Turn on two-step verification. Remove unknown administrator users and review who has access. If a login was reused elsewhere, change it there too.
Find the cause and clean up
Compare the site with a known clean backup if you have one. Common entry points are outdated plugins or themes, stolen passwords and pirated software. Restoring a clean backup is often faster than hand-cleaning, but update everything immediately after, or the same hole will be used again.
If there is no clean backup, a professional cleanup service or your host's security team can remove malicious code and check for hidden back doors that let attackers return.
Handle search and browser warnings
If a search engine or browser flagged your site, fix the problem first, then request a review in Search Console. Remove spam pages and make sure they return a not found status. Warnings often clear within days after the review, though timing is outside your control.
Check your email deliverability too. Compromised sites sometimes send spam, which can harm your reputation.
Notify and prevent a repeat
If your site collected personal information such as names, addresses or payment details, you may have notification duties under state or other laws. Talk to an attorney about your obligations, and tell your payment processor if card data may be involved. Be honest and brief with customers about what happened and what you did.
Afterward, set up backups, updates, monitoring and least-privilege access. Write down what you learned in a short incident note.
What to collect for the cleanup
Save notes as you go: when you first noticed the problem, what you saw, which pages were affected, and which passwords you changed. Ask your host for access logs and scan results, and keep screenshots of warnings. This information helps whoever cleans the site find the entry point, and it helps if you need to file a claim or report.
Also check Search Console for a security issues message and for new owners or users you do not recognize.
Take a breath before contacting customers. A calm, short message that says what you know and what you are doing is better than a speculative warning. Update it as facts become clear, and keep records of what you sent.
Common questions
Should I pay a ransom?
Seek professional guidance first. Paying does not ensure your data is returned, and good backups usually remove the need.
Will my rankings recover?
Usually, once the problem is fixed and any warnings are cleared, though recovery time varies.
Can I clean it myself?
Simple infections sometimes can be, but hidden back doors are easy to miss. Professional help is worth considering.
This guide is general information. Search engines change how they work and their guidelines; check Google's current documentation for your situation. Nobody can guarantee a ranking.