Website hacked? Here's how to fix it, in plain words.

In short: don't delete the site, change every password from a clean device, clean the site including the hidden way back in, then request a review in Google Search Console. Google says: "A review can take from a few days to a few weeks to complete."

PHP2Shell: the critical PHP flaw (updated 26 Oct 2026)

PHP had a critical security release on 21 October 2026, for a flaw being called PHP2Shell. PHP is the code that runs a large share of websites and online tools behind the scenes, so this is not only a WordPress problem: sites and services on any platform can be affected. Our PHP security update guide explains who has to fix it.

Running a Magento or Adobe Commerce store? Our Magento store hacked guide covers CVE-2026-48356, the flaw attackers are using against stores now.

If you manage your own hosting

WordPress.org's post on the release says PHP versions before 8.2 no longer get security updates. If your server runs one of those, it says to consider taking the server offline while you update. It quotes the UK National Cyber Security Centre: "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated."

Hosted tools were hit too

It wasn't only self-hosted sites. Acuity Scheduling, a booking tool owned by Squarespace, was taken offline on 21 October "while we address PHP2SHELL". Its status page marked the maintenance completed at 14:41 EDT the same day.

• Ask your host which PHP version your site runs, and whether the 21 October fix is in.
• If you run your own server on PHP older than 8.2, update it, or take it offline until you can.
• If you use an outside booking, shop or form tool, check its status page for notices.

Read WordPress.org's post on the release and Acuity's status notice.

Two WordPress plugin notices from October 2026

In mid-October, two widely used WordPress plugins published security notices. If your site uses either one, check these three things. Below we only repeat what each company's own notice says, so read the notice in full too.

1. Rank Math SEO PRO

Rank Math says some downloads of PRO version 3.0.123 were malicious. Its notice covers copies downloaded or updated between 20:02 UTC on 15 October 2026 and 07:12 UTC on 16 October 2026. Version 3.0.124 is the clean release. Rank Math says the free version from WordPress.org was not affected.

• Check whether your site runs Rank Math PRO, and which version.
• If 3.0.123 was installed and activated in that window, Rank Math's advice is to treat the site as compromised and restore your files and database from a backup made before the window started.
• Get 3.0.124 by logging in at rankmath.com yourself, not from a link in an email.

In Rank Math's words: "The affected plugin files contained malware that could compromise your website if the plugin was activated."

Read Rank Math's security notice.

2. UpdraftPlus

TeamUpdraft, the company behind the UpdraftPlus backup plugin, published a notice about a security incident involving UpdraftCentral connection keys. It says to update to UpdraftPlus 1.26.13, or Premium 2.26.13, or later.

• Update UpdraftPlus to 1.26.13 or later.
• Open your WordPress users list and look for any administrator you don't recognise.
• In UpdraftPlus, under Advanced Tools, then UpdraftCentral, check for connection keys you don't use.

In TeamUpdraft's words: "Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website."

Read TeamUpdraft's security notice.

3. Your Search Console owners

Open Google Search Console yourself, not from a link in an email. Go to Settings > Users and permissions, and remove any owner you don't recognise.

Not sure whether your site uses either plugin? Ask us in the chat.

"Deceptive site ahead" on your website?

What the red warning means

Chrome shows "Deceptive site ahead" when Google finds content on a site that tricks visitors into doing something dangerous, like typing in a password or downloading harmful software. Google calls this social engineering. Often the owner didn't put it there: a hacker did, or an advert or outside service on the page did.

What to do today

1. Don't delete the site. Google needs to see it to check it again.
2. Change every password from a clean device: hosting, website login, email and domain company. Turn on two-step login.
3. Tell customers only what's true. For example: "We're fixing a problem with our website. Please call or message us directly."

How the warning gets cleared

Remove everything harmful, including the hidden way back in, and check any adverts or outside services on your pages. Then open the Security Issues report in Search Console, Google's free tool for website owners, and request a review. Google sets the timing, not us: "A review can take from a few days to a few weeks to complete."

Want every step in order? See how to clear "Deceptive site ahead".

Japanese spam pages in Google?

What the Japanese keyword hack is

Hackers create pages of automatically written Japanese text in randomly named folders on your site. The pages link to shops selling fake brand goods, and Google can list them in search results. Some attackers also add themselves as an owner in Search Console, so they can change settings like your sitemap.

Why the pages stay in Google after the clean-up

Google keeps pages on file until it checks them again. Make sure the spam addresses now return "not found", remove any sitemap you don't recognise, and remove any Search Console owner you didn't add. If you open your sitemap to check it and Chrome shows code, see why a sitemap shows code in Chrome. The Removals tool only hides pages for a while. Google says a successful request "lasts only about six months", and that using the tool alone won't remove a page for good.

What we can and can't promise

Nobody can promise when your rankings come back, and we won't. What we can do is show you every step we took, and what Google reports before and after.

A "new owner" email about your website?

Check it without clicking anything

Search Console tells existing owners when a new owner is added. Fake versions of emails like this are used to steal logins, so don't click links in the email. Open Search Console yourself, in a new tab, and look at the list of owners.

If someone really was added

Google's advice is to email the person first, in case it's someone you know using another address. If they don't reply, or you didn't add anyone, remove them and delete their verification token, such as an HTML file on your site. Google warns that removing the token is only a temporary fix, because the way in may still be open. So secure the site too.

If you clicked a link or typed a password

Change that password from a fresh tab, never from the email. Turn on two-step login, and check your website and Search Console for users you don't recognise. Not sure an email is real? Ask us in the chat or on WhatsApp before you click anything.

Why hacks come back

If the way in stays open, the attacker can walk straight back in. That's why closing the hole matters as much as the clean-up: an old add-on, a weak or shared password, or a login left behind by someone who no longer works on your site.