A suspected website compromise needs technical investigation and disciplined communication at the same time. Ask qualified responders or your hosting provider to contain the problem and preserve relevant evidence. Publish only confirmed information about service availability and user impact. Removing an alarming search result alone does not repair the compromised website.
01
Establish what is known
Record the affected URLs, warning messages, detection time and who observed the problem. Use a clean, trusted communication channel for the response team. Avoid casually deleting files or logs that responders may need. Distinguish visible defacement, unauthorized redirects and possible data exposure; one finding does not automatically prove the others occurred.
02
Give technical work a clear owner
The responsible team should assess access, affected systems, recovery options and the cause of the incident. Google identifies Search Console’s Security Issues report as one source of information about detected problems. It is an input to investigation, not a complete forensic assessment. Follow the relevant review process after the underlying issues are addressed.
- Confirm who can authorize containment or temporary service changes.
- Preserve a timeline of technical actions and public statements.
- Have appropriate specialists assess any notification duties.
03
Keep customers informed without speculation
For example, if a checkout page is temporarily unavailable, provide a verified alternate support route and the time of the next update. Do not promise that no data was affected before the investigation supports that conclusion. After restoration, verify important customer journeys and monitor for recurrence. Explain confirmed changes without publishing details that could expose customers or undermine recovery.
Frequently asked questions
Should we immediately say the site is safe?
Only make a claim that the responsible technical team can support. Describe the verified status and remaining investigation instead of offering absolute reassurance prematurely.
Will restoring a backup solve everything?
A backup may be part of recovery, but it does not establish that the entry point, compromised access or affected copies have been addressed. Let qualified responders validate the recovery.
Continue with your next step
Related guides on this topic
Sources and policies
Check the current policy before submitting a request.
You do not have to figure out the next step alone.
Share the URLs and explain your concern. We will review the context and explain which options are worth assessing.
Request a confidential reviewOr call (307) 429-2531Educational information, not legal advice. Outcomes depend on the facts and decisions made by third parties.