The first hour
- Contain it: take the site offline or into maintenance mode. A hacked site serving junk to customers does more damage per hour than downtime does.
- Change every password: hosting, the site's admin login, the database, and the email tied to them. Assume all of it leaked.
- Keep the evidence: a copy of the broken state helps find how they got in. Resist the urge to delete first.
The first week
- Restore from a backup older than the break-in, which may be further back than you would like. This is where keeping weeks of copies earns its keep.
- Close the hole: restoring without fixing the way in (almost always outdated software or a weak password) books the next incident.
- Check what Google thinks: if the site was flagged, ask for a review in Search Console. "This site may be hacked" labels outlive the hack.
- Tell people if data was involved: if the site holds customer data, Irish businesses have GDPR duties with a 72-hour notification clock. Talk to your advisor; do not guess.
The part that prevents the sequel
Every step above is easier as a system: a machine watching the site notices the break-in, restore-tested backups make the recovery boring, and a weekly update cycle removes the way in before the robots find it. That system is what maintenance is.