Hacked Website Recovery & Rebuild
Separate legitimate content from compromised code and rebuild an affected website without carrying malware into the replacement.
Contain before rebuilding
Change credentials, preserve forensic copies and avoid continuing to edit an actively compromised installation as though it were trustworthy. If the incident is serious, involve the host or a qualified security professional.
Assume executable files may be tainted
Obfuscated PHP, unexpected JavaScript, unfamiliar cron jobs, hidden admin users and modified core files should be treated as evidence. A static rebuild is useful when the public site only needs content, because it lets you recreate pages without reusing the compromised runtime.
Recover content from clean representations
Use database text exports, rendered pages, media files that can be inspected and known-good backups. Do not restore a full old installation into production merely to save time unless you have validated it.
Reset the perimeter
Rotate hosting, CMS, database, FTP/SFTP, email and API credentials as appropriate. Review DNS and administrator accounts. The rebuild is incomplete if the attacker can simply return through an unchanged credential.
Monitor after launch
Watch server logs, search-console warnings, unexpected redirects and new files. A clean static site reduces many application-level risks, but it does not remove the need for secure hosting and account management.
Preserve evidence before cleaning
Take a read-only copy of suspicious files, timestamps and logs before deleting them if the incident may require investigation. Cleaning first can destroy clues about the entry point, affected accounts or duration of compromise. Do not expose the preserved copy publicly.
Rebuild trust boundaries
After a compromise, reconsider which systems actually need write access to the public website. Static publishing can isolate content creation from production serving, while forms and booking functions can run through smaller dedicated services. Reducing write-capable components narrows the impact of future failures.