Your Website Was Hacked and a Casino Appeared on the Homepage: What to Do in the First 24 Hours

How to tell if your website was hacked

The signs can be obvious or hidden. Obvious signs are visible to every visitor, while hidden ones are noticed only by search engines or the owner if they know where to look.

1. Unwanted ads appeared on the homepage. Casino blocks, betting ads, or other content you never posted, or a full page replacement.
2. The website redirects to third-party addresses. Sometimes only from mobile phones or only from search engines, so everything looks normal when visiting directly.
3. Unfamiliar pages appeared in search results. When searching site:your-domain, search results show hundreds of pages in foreign languages or for products you do not have.
4. The browser or search engine warns of a dangerous site. A red screen before entry scares visitors away more than any advertising budget.
5. The request form stopped sending emails or sends them to the wrong address.
6. The web host blocked the website or sent a complaint about malicious code.
7. The website became slow without traffic growth, and new users you did not create appeared in the admin panel.

Keep in mind: the owner is often the last to notice a hack. Spam and redirects are frequently shown only to search bots and visitors from search results, so regularly check your search listings and reports in Google Search Console and Yandex Webmaster.

Why websites get hacked

Automated programs look for websites with known vulnerabilities; they are not targeting you personally. Most often, the cause is one of the following:

• an outdated CMS, theme, or plugin with a known vulnerability;
• a weak or reused password, or shared access without two-factor authentication;
• exposed system files: database backups, error logs, or configuration files accessible via a direct link;
• unrestricted forms and login portals where attackers can brute-force passwords and send thousands of requests;
• forgotten subdomains and obsolete DNS records pointing to an unfamiliar or abandoned server;
• connected third-party scripts and plugins of unknown origin.

That is why cleaning a website without finding the entry point does not work: if the root cause remains, the hack repeats within a few days.

What to do in the first 24 hours

First, stay calm and act methodically.

1. Do not delete everything indiscriminately. First, preserve the current state: make a copy of the files and the database so you can find the entry point.
2. Lock down access. Change passwords for hosting, the admin panel, FTP, and the database. If the website is actively sending spam or malicious code, display a "Maintenance" page while work is underway.
3. Find the entry point. The cause is usually an outdated plugin, a stolen password, or an exposed file.
4. Clean the website. Remove malicious code, third-party pages, and unauthorized users, then restore altered files from a clean backup.
5. Update everything that can be updated, and delete anything unnecessary.
6. Check email and domain DNS. Sometimes attackers breach domain access rather than the website itself.

What not to do: roll back the website to an old backup before finding the entry point, keep the old passwords, or pay anyone promising to "fix it in an hour" without explaining the cause.

How to return your website to search

Once the website is clean, you need to make sure search engines recognize it.

• Open Google Search Console and Yandex Webmaster, navigate to the security issues section, and submit a reconsideration request.
• Remove third-party pages from search results: return the correct HTTP status code for them and use the URL removal tool.
• Check your robots.txt file and sitemap: attackers sometimes replace them.
• Monitor search rankings and indexing errors for several weeks after cleanup.

The time needed to recover rankings depends on how long the website remained compromised and how many spam pages were indexed.

What protects best: a checklist

1. Scheduled core CMS and plugin updates at least once a month, along with removing unused ones.
2. Unique passwords, a password manager, and two-factor authentication for the admin panel, hosting, and email.
3. Scheduled off-site backups and recovery testing. A backup you cannot restore from is not a backup.
4. HTTPS across all pages and security headers.
5. Secured system files: no database backups, logs, or configuration files in public directories.
6. Login attempt rate limiting, plus spam and bot protection for forms.
7. Principle of least privilege: each employee and contractor gets only the access they strictly need.
8. Monitoring: alerts if the website is unavailable, the SSL certificate or domain expires, or files change.
9. Clean DNS configuration: remove records pointing nowhere and delete unused subdomains.
10. An incident response plan: who does what and who to call.

Frequently asked questions

Can you rely on a security plugin alone?

A plugin addresses some risks, but it does not replace updates, backups, and proper access control. It works best as one layer of defense.

How often should you check your website for hacks?

After any changes and regularly on a schedule. For online stores and portals with client portals, it is best to set up continuous uptime monitoring and file change tracking.

What should you do if your website was hacked and you have no backup?

Save the current state, revoke access, and contact a specialist. Most of the time, the website can be cleaned, but it takes longer and costs more than restoring from a clean backup.

Does this apply only to large websites?

No. Automated programs do not distinguish between large and small websites, so brochure sites and landing pages get hacked just as often as online stores.