Think your website was hacked? Signs to check and what to do in the first 24 hours

The short answer

After a flaw like PHP2Shell, check your site for new administrator accounts, unfamiliar files, pages you did not write showing in Google, redirects to other sites, warnings from your host and a Security Issues report in Google Search Console. If you find any of them, contact your host first and ask them to isolate the site and preserve the logs. Then make sure PHP is patched, restore from a clean backup, change every password, and decide whether you have to report a privacy breach. The checklist below is in the order we would do it.

A quiet site is not proof of a clean one. Many break ins add nothing visible and wait. That is why the checks matter even if the site "looks fine".

Signs to check today

The Canadian Centre for Cyber Security's PHP2Shell alert asks organizations to review web server, application and sign in logs, and to look into unexpected processes, files, accounts or outbound connections linked to PHP or the web server. Those are jobs for your host or developer, so ask them directly.

Google's Security Issues report in Search Console flags hacked content, malware and deceptive pages. Affected pages can show a warning in search results or in the browser, which is often how customers notice first.

If you find something: the first 24 hours

1. Do not wipe the site yet. Deleting files destroys the evidence of how the attacker got in and what they touched. Take screenshots of what you saw, with the time.
2. Call in your host or developer. Ask them to isolate the site, for example by serving a static maintenance page at the server level, and to preserve the web server and PHP logs. See how to take a site offline without hurting your Google ranking.
3. Close the door. Make sure PHP is patched to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or a vendor build with the fix. Restoring a backup onto an unpatched server just lets the attacker back in. Our guide on checking your PHP version explains the numbers.
4. Restore from a clean backup. Details of these flaws leaked online on October 20, 2026, so we would prefer a backup made before that date and then add back any orders or posts made since. Ask your host which backups they keep; many keep daily copies for a limited time.
5. Change every password and key. Hosting account, WordPress administrators, database, FTP or SFTP, email accounts on the same domain, and any payment or API keys stored on the site. Turn on two step sign in where it is offered.
6. Remove what does not belong. Delete unknown users and confirm with your developer that unknown files and scheduled tasks are gone after the restore.
7. Ask Google to review the site. Once every issue is fixed on every page, select Request Review in the Security Issues report. Google says to explain the issue, what you fixed and the result, not to resubmit while a review is pending, and that most reviews take several days to a few weeks.

If customer information may have been exposed

If your site stores names, emails, phone numbers, addresses, account logins or order details, a break in can be a privacy breach under Canadian law. The Office of the Privacy Commissioner of Canada says that under PIPEDA, a business must report a breach of security safeguards to the Commissioner and notify the affected people when it is reasonable to believe the breach creates a real risk of significant harm. That test looks at how sensitive the information is and how likely it is to be misused, not how many people are affected.

Two points small businesses often miss:

• You must keep a record of every breach, even ones you decide not to report, for at least two years. Write down the date, what happened, what information was involved and what you decided.
• You stay responsible even when a supplier holds the data. The OPC says the organization in control of the personal information is responsible, even if a third party such as a host processes it.

Businesses in Quebec, Alberta and British Columbia may fall under provincial private sector privacy laws instead of, or as well as, PIPEDA. We are not lawyers; if customer data was involved, get advice for your province.

You can also report suspicious activity linked to PHP2Shell to the Canadian Centre for Cyber Security through My Cyber Portal or by email at contact@cyber.gc.ca, as its alert AL26-026 invites.

Common mistakes

• Installing a security plugin and calling it done. A scan can help find changed files, but it cannot patch PHP and may miss code placed outside WordPress folders.
• Restoring the newest backup. If the attacker got in before it was made, you restore the problem.
• Changing only the WordPress password. Attackers who reach the server often read the database password and other keys stored in configuration files.
• Telling customers "no data was affected" too early. Wait until your host or developer has looked at the logs.

Our take

No signs found: good. Write down that you checked and when, make sure your host has confirmed the PHP patch, and check the Security Issues report again in a week.

Signs found on a brochure site with no customer data: isolate, patch, restore and change passwords today. The legal reporting duty is unlikely to apply, but your reputation in Google results does, so finish with a review request.

Signs found on a site with customer accounts, orders or forms: treat it as a possible privacy breach from the start. Keep notes from hour one, involve your host or developer before deleting anything, and get advice on reporting.

Web designer: if one client site on a shared server is hit, check every other site on that server and account, not just the one that showed symptoms.

For the full picture of what PHP2Shell is and who has to patch it, start with what small business websites should do about PHP2Shell.

Sources

• Canadian Centre for Cyber Security: AL26-026 Critical vulnerabilities impacting PHP
• Google Search Console Help: Security issues report
• Office of the Privacy Commissioner of Canada: Mandatory reporting of breaches of security safeguards
• PHP: Security advisory, critical remote code execution vulnerabilities (October 21, 2026)
• Huntress: php2shell, leaked critical PHP vulnerabilities