1. Notify support and limit exposure.
Tell support the domain, service, symptoms and start time with its time zone. Agree on temporary restrictions based on the risk. Involve the people responsible for affected data collection or payments. Do not continue using a suspicious checkout flow.
2. Preserve evidence and the current state.
Record URLs, messages, unfamiliar accounts and recent changes. Preserve logs and a copy of files and database in a protected, restricted location. Do not wipe or restore before preserving evidence. Do not share malicious samples through ordinary channels.
3. Investigate the cause with technical help.
Review the application, plugins, credentials, permissions, integrations and other sites on the account. A single scan does not prove the whole environment is clean. Do not run commands or remove files without understanding their impact.
4. Recover and close the entry point.
Assess a pre-incident backup without assuming it is clean. Where possible, recover in a separate environment and replace compromised components with legitimate updated versions. Fix the entry point before returning to production.
5. Revoke access and validate recovery.
From a trusted device, rotate exposed credentials and revoke affected sessions, tokens and keys. Test pages, logins, forms, checkout and integrations. Monitor logs and alerts. Request search-engine security reviews only after remediation; each service handles its own assessment.
What to tell support
Domain or service, time and time zone, symptoms, recent changes and actions already taken. Do not send passwords or malicious samples.
Open account supportCommon questions.
Does a slow or unavailable site necessarily mean a hack?
No. DNS, certificate, application, resource or connection problems can produce similar symptoms. Record the error and seek a diagnosis.
Does restoring a backup guarantee a fix?
No. The backup may already be affected and the same vulnerability may remain. Recovery, remediation, access review and validation all belong in the plan.
Further references.
Official guidance for exploring these practices further.