Short answer: If your website is hacked, do five things: preserve evidence and back up the current state, change every password, take the site offline or show a maintenance page, find and patch the entry point before cleaning, then request a review in Google Search Console. Sites cleaned without patching the hole are often reinfected within 1–3 months.
A hack costs more than a broken site. Visitors redirected to a gambling page rarely return; a Google "this site may be hacked" label sends clicks sharply down; sites holding member data also face breach-notification duties. On November 3, Google's John Mueller replied to a case where, after cleanup, only the homepage stayed indexed; he noted a hack left in place for months can affect search quality long afterward. The sooner you act, the smaller the damage.
Five emergency actions to take now
Bottom line: stop the bleeding, then investigate; don't delete everything the moment you notice.
- 1. Preserve evidence: have your host or developer back up files, database and access logs so the entry point can be found.
- 2. Change every password: site admin, hosting panel, FTP/SSH, database, domain registrar and email, with two-factor authentication.
- 3. Go offline temporarily: show a maintenance page so visitors stop being redirected.
- 4. Find the entry, then clean: compare modified files and timestamps, patch the hole, then rebuild from a clean backup or source code.
- 5. Request a review: confirm cleanup in Search Console's Security Issues report and request review; Google usually takes several days.
Six common causes and fixes
Bottom line: most small-business sites in Taiwan aren't targeted by experts; they're simply out of date.
| Cause | Symptom | Fix |
|---|---|---|
| Outdated plugins or themes | Unknown admins, Japanese spam pages | Remove unused plugins, update the rest |
| Weak or shared passwords | Admin logins, altered content | One account per person, strong passwords, 2FA |
| Old server or language versions | Several sites on one server infected | Upgrade to officially supported versions |
| Upload forms without file checks | Executable files in upload folders | Allow only images/documents; block execution in uploads |
| Leaked FTP or hosting credentials | Homepage replaced entirely | Disable FTP, use key-based SFTP |
| Injected third-party scripts | Only some visitors redirected | Audit external scripts, remove unknown ones |
Google's web.dev guide to spotting a hacked site covers common attacks such as Japanese keyword spam, gibberish pages and cloaked keywords and links, useful for matching symptoms.
When to call a pro vs handle it yourself
Bottom line: if member data or payments are involved, or you can't find the entry point, call a professional.
- DIY: brochure sites with no members or payments, a known plugin hole and a clean backup.
- Call a pro: member or order data, reinfection after cleanup, multiple sites on one server, or a Google security warning.
- Must report: if personal data may have leaked, Taiwan's Personal Data Protection Act (Article 12) requires notifying affected people after investigation; you can also report to TWCERT/CC.
Prevention checklist
Bottom line: 30 minutes a month on these 8 items prevents most hacks.
- ☐ Update plugins, themes and framework monthly
- ☐ Remove plugins and accounts unused for 6 months
- ☐ Two-factor authentication on every admin account
- ☐ Daily automatic backups stored in a separate location
- ☐ Quarterly restore test
- ☐ Server and language versions within official support
- ☐ Search Console verified with email alerts on
- ☐ Domain and hosting accounts in the company's name
FAQ
Does a hack hurt Google rankings?
Yes. Google may show warnings or drop hacked pages; the longer it lasts, the slower recovery. Request a review after cleanup.
Must a hacked site be rebuilt?
Not always. Patch the entry point and restore a clean backup; rebuild only if hosting and framework are badly outdated.
How can I tell if my site was hacked?
Search site:yourdomain for unfamiliar pages, then check the Security Issues report in Search Console.
How much does hack cleanup cost?
For a simple brochure site, often about NT$5,000–30,000. Membership, payments or rebuilds are quoted by scope.
Website hacked? Start with a free check
ScriptWalker (a Taiwanese Laravel/Flutter custom development studio) handles emergency response, patching and rebuilds after a hack, plus monthly backup and update maintenance from NT$2,000/month. Send us your URL for a free check for signs of compromise.
- Email: [email protected]
- Phone: 0916-224-047
- LINE: @ufv9089p