A ransom note on a website is more than an IT problem. For a small business, charity or sole trader, it can stop enquiries, bookings, sales and access to essential information. Effective ransomware website recovery starts with calm containment: prevent further damage first, then restore only data you can trust.
Act quickly, but do not make the problem worse
If your website begins displaying an unfamiliar message, redirects visitors elsewhere, files are encrypted, or you receive a demand for payment, take the affected site offline or place it in maintenance mode. If you have access to your hosting control panel, change the hosting account password immediately from a known-clean device. Do the same for administrator accounts, FTP or SFTP users, database users, domain registrar access and email accounts that may be connected to the website.
Do not delete files, reinstall the site straight away or overwrite existing backups. Those actions can remove useful evidence and, more importantly, may replace the last known clean copy with an infected one. Make a record of what you see, including screenshots of any ransom note, the time the problem was found, affected pages and recent suspicious emails or login alerts.
If staff computers are involved, disconnect those devices from the network and ask users not to sign in again until they have been checked. A website infection and a device-wide ransomware incident are not always the same event, but they can be connected through saved passwords, compromised email accounts or infected files.
Understand what has actually been affected
The right recovery route depends on the scope of the incident. A compromised WordPress administrator account may allow an attacker to alter pages or add malicious code, while ransomware on a laptop may encrypt local copies of website files, customer documents and email archives. In a more serious case, an attacker may have accessed both the website and the hosting account.
Before restoring anything, establish whether the following are affected: website files, the database, business email, hosting credentials, domain settings and any connected payment or booking system. Check whether visitors have reported warnings, spam messages or unexpected redirects. Review recent users and file changes where records are available.
This assessment matters because restoring the visible website alone may not remove the original entry point. For example, a clean website backup will not solve the problem if a stolen administrator password is still active. Equally, changing passwords will not repair a database that has been encrypted or replaced.
Choose the right clean backup
Backups are often the quickest route to ransomware website recovery, but only if the restore point predates the attack. The newest backup is not automatically the safest one. Malicious code can sit unnoticed for days or weeks before it causes obvious disruption.
Start with a recent backup, then check it carefully before making it live. Look for the correct website pages, products, posts, contact forms and database content. Confirm that the files have not been modified by the attack and that the backup was created before the first suspicious activity. If there is any doubt, use an earlier restore point rather than risking a reinfection.
A complete website restore usually needs both files and database content. Restoring files without the matching database can lead to missing pages, broken logins or out-of-date orders. Restoring a database without the required application files can cause similar problems. If your site uses a content management system, its themes, plug-ins and uploads also need checking.
For business-critical sites, consider restoring the backup to a separate test location first. This provides an opportunity to scan the site, check key journeys and make sure no malicious code remains before visitors return. It may take a little longer, but the trade-off is far less risk of putting an infected site back online.
Restore the site and test what customers use
Once you have identified a clean backup, restore it through your hosting control panel or with help from your hosting provider. Keep a note of the date and time of the chosen backup, along with every password reset and configuration change made during the incident. Clear records make follow-up checks much easier.
After the restore, test the website as a visitor would. Open the home page and several internal pages, submit a contact form, test account logins and check that email notifications arrive where expected. If you take payments or bookings online, run a safe test transaction where possible. Check mobile views too, as malicious redirects can sometimes affect only certain devices or browsers.
Also review domain DNS settings, website redirects and administrator users. Attackers may alter these to retain access or send customers to fraudulent pages. Remove unknown users, expired staff accounts and plug-ins or themes that are no longer needed.
Close the route the attacker used
A restored site is only secure if the original weakness has been addressed. Update the website platform, themes, plug-ins and server-side software supported by your hosting service. Remove abandoned extensions rather than leaving them installed but inactive. Old plug-ins are a common route into small business websites because they are easily overlooked.
Use unique, long passwords for every service and enable multi-factor authentication wherever it is available. Avoid sharing a single administrator login among several people. Individual accounts make it easier to remove access when someone leaves and to understand what happened if there is a future issue.
Check file permissions, review who has access to the hosting account and make sure FTP is not being used where SFTP is available. If the website stores customer information, assess whether personal data may have been accessed. Depending on the circumstances, you may need to seek specialist advice and consider your reporting obligations under UK data protection law.
Paying a ransom is rarely a dependable recovery plan. It does not guarantee that files will be returned, that stolen data will be deleted or that the attacker has lost access. A verified backup, cleaned credentials and careful testing give you a far more controlled route back online.
Build a recovery plan before the next incident
Daily backups provide valuable protection, but they are not a substitute for a recovery process. Decide who can authorise a restore, where backup dates are checked, who communicates with customers if the website is unavailable and how credentials are stored securely. Keep a copy of these details outside the website itself.
Your backup retention period should reflect how often your content changes and how much data you could realistically recreate. A brochure site updated once a month has different needs from an online shop receiving orders every day. Keep more than one restore point, and make sure at least one copy is separate from the main website environment.
It is also worth practising a restore occasionally. A backup that has never been tested may be incomplete, inaccessible or too old to be useful when pressure is highest. Test restores reveal gaps while there is time to fix them.
Pac Web Hosting customers can seek support when they need help understanding hosting access, backups or the practical steps involved in restoring a website. The priority is to return the site safely, not simply to return it quickly.
When specialist help is needed
Contact your hosting provider promptly if you cannot access the control panel, suspect the server account has been compromised or need help identifying available backups. If customer data, payment details or multiple devices may be affected, involve a qualified cyber security professional as well. They can help preserve evidence, investigate the entry point and advise on wider containment.
Clear communication protects trust. If your site will be offline for more than a short period, use your social channels, business listing or a recorded telephone message to tell customers that you are aware of the issue and working to restore services. Keep the message factual. Do not speculate about the cause before it has been investigated.
The best time to plan ransomware website recovery is before you need it: maintain clean backups, limit access, keep software current and know who to call. Those straightforward measures give a smaller organisation the breathing room to recover with confidence when an incident occurs.
