---
title: Clean up a hacked site
description: "If your site shows pages you didn't make, sends visitors somewhere else, or has files you don't recognize, work through these steps in order. You can do most of them in your control panel. ## Before you start - Open…"
url: "https://getsimple.net/knowledgebase/clean-up-a-hacked-site/"
updated: "2026-11-01"
category: Your hosting panel
---

# Clean up a hacked site

If your site shows pages you didn't make, sends visitors somewhere else, or has files you don't recognize, work through these steps in order. You can do most of them in your control panel.

## Before you start

- Open your control panel. See [How to open your control panel](/knowledgebase/open-hosting-panel/).
- Work out roughly when the problem started. You will pick a backup from before that date.
- Backups are kept for 30 days. If the problem started earlier than that, open a ticket from [Get Help](/knowledgebase/get-help/) before you restore.

## Step 1: Save a copy of the site as it is now

A restore replaces what is there now. Save a copy first, in case you need something from it later.

1. Open **Websites** and select your site.
2. Open the **Backups** tab.
3. Select **Backup now**.

## Step 2: Restore a clean backup

1. On the **Backups** tab, find a backup from before the problem started. Each row shows the date and time it was made.
2. Open its **Restore** menu and choose **Custom**.
3. Use the **Files** and **Databases** tabs to choose what to restore. Leave **Emails** alone unless your mail was affected.
4. Select **Restore now**.

You can't restore a single file. Files are restored all together or not at all. See [Back up and restore your site](/knowledgebase/back-up-and-restore-your-site/).

After the restore, look through your site's files. If you see files or folders in public_html that you don't recognize, open a ticket from [Get Help](/knowledgebase/get-help/) before you delete anything.

## Step 3: Change every password

Change these in this order. See [Reset a password for your account, email or database](/knowledgebase/reset-a-password/) for each one.

1. **Your Get Simple account.** Your control panel opens from this account, so protect it first.
2. **Your WordPress or Joomla admin.** Change it from your site's admin, and remove any admin users you don't recognize.
3. **Your database user.** Open **Databases**, then the **Users** tab, then the three-dot menu next to the user, then **Manage**. Next to **Password**, select **Reset**, enter a **New password** and select **Change password**. Then put the new password in your app's settings (for WordPress, wp-config.php; for Joomla, configuration.php).
4. **Your FTP accounts.** Open **Advanced**, then **FTP**. On each row, open the three-dot menu and select **Manage**. Next to **Password**, select **Reset**, enter a **New password** and select **Save**. Delete any account you don't use with **Delete** on the row's three-dot menu.
5. **Your mailboxes**, if your site's contact forms or mail were affected.

## Step 4: Turn on two-factor authentication

Turn it on for your Get Simple account. See [Turn on two-factor authentication for your Get Simple account](/knowledgebase/two-factor-authentication/).

## Step 5: Update everything

1. Update WordPress or Joomla to the latest version.
2. Update every plugin, extension and theme.
3. Remove plugins and extensions you don't use.

A restored backup puts back the versions you had then. If those were out of date, update them again right away.

## Still seeing problems?

Open a ticket from [Get Help](/knowledgebase/get-help/). Tell us the site, when the problem started, and which backup you restored.

## FAQ

### Should I restore before or after changing passwords?

Restore first, then change passwords. If your site can't connect to its database after a restore, open a ticket from [Get Help](/knowledgebase/get-help/).

### Can I restore just the infected files?

No. Files are restored all together or not at all.

### My backup list doesn't go back far enough. What now?

Backups are kept for 30 days. Open a ticket with the site and the date you need, and we will tell you what is available.

## Related

- [Back up and restore your site](/knowledgebase/back-up-and-restore-your-site/)
- [Reset a password for your account, email or database](/knowledgebase/reset-a-password/)
- [Turn on two-factor authentication for your Get Simple account](/knowledgebase/two-factor-authentication/)
- [Get Help](/knowledgebase/get-help/)