First steps after a suspected compromise
Before you start digging into the damage, make sure you can get in touch with your hosting provider. You should inform them that your site has been compromised as soon as possible. They can check whether their other customers are at risk and may be able to help you restore your site from backups or clean copies of your files.
Find reliable help and communities
Recovery can be a long process, and it helps to know who to ask when you get stuck. Beyond the guidance in this series and your hoster's own documentation, search for discussion forums and online communities where site owners discuss security incidents. Reading through past questions can be valuable, and posting your own can connect you with people who have been through the same situation.
The Google Search Central discussion forum has a dedicated subforum for malware and hacked sites, where responses often come from the community's Product Experts and other highly engaged members.
Assess whether to fix it yourself or hire a professional
Cleaning up a compromised site is a technical task. To do it yourself, you will need to be comfortable reading and understanding code, using command-line tools on your server, and potentially changing web server configurations. If that does not describe you, consider bringing in a qualified professional.
Once you decide to hire someone, look for help through referrals from well-regarded members of trusted online communities. Another route is to move your site to a new hoster that specializes in site recovery, and have them handle the cleanup as part of the transfer process.
