What to do if your website or email is hacked

Warning signs

• Emails you did not send, or contacts telling you they received strange messages from you.
• Replies and invoices going missing, or forwarders and filters you did not create.
• Your website shows content you did not add, redirects visitors somewhere else, or your search results show odd pages.
• A security notice from us, or a sudden suspension for suspected spam or malware.

Act quickly: step by step

1. Change your passwords now on a clean device: the affected mailbox, cPanel, your website admin, FTP accounts and the Client Area. Use new, unique passwords. See How to create a strong password.
2. Check forwarders and filters in cPanel and delete any you did not make. See Email filters and Forwarders.
3. Scan your own computer and phone for malware. A stolen password often starts on an infected device.
4. For a website: update the software and plugins, delete unknown admin users and unused plugins, and restore from a clean backup if you have one.
5. Warn people who may have received fake messages, especially if bank details or payments are involved. See How to protect yourself from email interception fraud.
6. Contact us straight away so we can help isolate and clean the account.

If we contact you about suspicious activity

If we spot spam, malware or suspicious logins on your account we may lock a mailbox or limit the account to protect you and other customers. We will tell you why. To get it back you will be asked to set a new strong password and fix the cause. Accounts used to send spam or malware can be suspended under section 6 of our Terms & Conditions.