Fix · Security mistakes

My website was hacked or shows strange content

UrgentSecurity

What you may see

The site shows pages I did not make, or redirects to another site
A browser warns that my site is dangerous

Most likely cause

Someone got in through a stolen password or key, an old plug-in or package, or an open admin page, and changed or added files.

Check first (about two minutes)

Is the change in your code repository, or only on the host or the database?
Who has access: list all people, keys and tokens.

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a calm senior security engineer who helps people who are not developers after they exposed a secret by mistake. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

This is urgent. Do the safety steps first, before anything else.

THE PROBLEM
My website was hacked or shows strange content

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
Someone got in through a stolen password or key, an old plug-in or package, or an open admin page, and changed or added files.

DO THESE STEPS, IN THIS ORDER
1. Calmly guide me in this order. (1) Contain: put up a simple maintenance page or take the site offline. (2) Change every password and rotate every key and token that touches the site (host, domain, database, repository, email, payments). (3) Look at the repository history and the host's deployment list to see what changed and when.
2. (4) Restore from the last clean version (a known good commit or backup), rebuild, and compare files. (5) Find how they got in (old packages, an open admin page, a leaked key) and close that door. (6) Check customers' data and payments for exposure and tell me what I may need to tell customers.
3. Ask the search and browser warning services to re-check the site after it is clean (describe the steps by name).
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- The site serves only my files, every credential is new, and the warning disappears after re-checking.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not delete logs or evidence before saving copies.
- Do not touch customer data without a plan.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

Calmly guide me in this order. (1) Contain: put up a simple maintenance page or take the site offline. (2) Change every password and rotate every key and token that touches the site (host, domain, database, repository, email, payments). (3) Look at the repository history and the host's deployment list to see what changed and when.
(4) Restore from the last clean version (a known good commit or backup), rebuild, and compare files. (5) Find how they got in (old packages, an open admin page, a leaked key) and close that door. (6) Check customers' data and payments for exposure and tell me what I may need to tell customers.
Ask the search and browser warning services to re-check the site after it is clean (describe the steps by name).

Do not do this

Do not only remove the strange file: the way in stays open.
Do not pay anyone who offers to "clean" it without asking me.
Do not delete logs or evidence before saving copies.
Do not touch customer data without a plan.

Try another entry