Emergency during the sales period

Site hacked or redirected during the sales: what to check, what to do

Sales, Black Friday, holidays: this is when a shop sells the most, changes the most things in a short space of time, and when a tampered payment page affects the greatest number of customers. Here's what to look for, in what order to act, what your hosting provider will expect from you, and how to preserve evidence of what happened.

Signs to look out for

A single one of these signs warrants a closer look. Check from a phone on the mobile network, and by arriving from a search engine: a conditional redirect hides precisely from the administrator.

Visitors land on a different site — often only from a phone, or only when coming from Google: from your own device, everything looks normal.
The checkout flow has changed: an extra field, a payment page that no longer looks like your provider's, a script loaded from an address you don't recognise.
Customers are reporting a fraudulent charge on the card they used with you, or a "weird-looking" payment page.
Pages you never wrote appear in search results for your domain, or in the "Security issues" report in Search Console.
The browser shows a warning before your page loads, or your hosting provider emails you — or even suspends the site.
An admin account you don't recognise, an extension installed without your knowledge, files modified at a time when nobody was working on the site.

The first steps, in order

Each step protects the next: copy before cleaning, protect customers before investigating, regain access before restoring.

Copy everything before you touch anything

The files, the database and the host's access logs, on separate storage. In the middle of a sale, it's tempting to clean up quickly and reopen: it's this copy that will later let you date the intrusion, work out which orders are affected, and respond to your host, your bank or your customers.

Protect paying customers first

If the checkout flow or the payment page could have been tampered with, stop taking orders or put the shop into maintenance mode while you check. A lost day of sales can be made up; copied customer card details cannot. If only the rest of the site is affected, an honest holding page is often enough.

Regain control of your accesses, in order

Hosting first, then FTP or SSH, the database, the store's admin panel and your providers' accounts (payment, carriers, marketing tools). Enable two-factor authentication everywhere it is available, and remove any accounts you don't recognise.

Notify your payment provider

As soon as card data may have been exposed, tell your payment provider or your bank: they know what to watch out for, and the PCI DSS standard governs these situations. Since version 4.0, it also requires keeping an inventory of the scripts loaded by the payment page and detecting any changes to them (requirements 6.4.3 and 11.6.1).

Notify within 72 hours if personal data is affected

Names, addresses, email addresses, order histories: if a personal data breach poses a risk to individuals, the GDPR (Article 33) requires that it be notified to the data protection authority within 72 hours of becoming aware of it — in France, the CNIL, via its online service. If the risk is high, the affected customers must also be informed (Article 34).

Get help, and file a complaint

In France, cybermalveillance.gouv.fr provides free guidance towards local service providers and explains how to file a complaint; in Germany, the BSI publishes first-response steps for businesses. The complaint is filed at a police station or gendarmerie, together with the copies from step 01.

Restore, then request a review

Restore the system and extension files to their vendor version, review anything that is your own, and update everything. If Google flags the site, request the review from the Search Console "Security Issues" report once the site has been restored, and only then: the review covers the state of the site at the time it is performed.

What the host needs

To reopen a suspended site, or lift a flag, the host wants to understand and verify. Prepare:

The time window: how long the behavior has been observed, and the likely date of the intrusion based on the logs.
The list of files added or modified, with their path and date, and what you did with them (removed, restored, quarantined).
The log excerpts showing the point of entry: addresses, requests, file uploads.
What was fixed: versions updated, extensions removed, passwords changed, accounts deleted.
The state reached after cleanup, established by an analysis that the host can review or verify.

How to prove what happened

Evidence is gathered at the very moment, or it is lost:

Keep the copies untouched, and record their fingerprint (SHA-256) at the time you make them: a fingerprint taken that same day later proves the copy hasn't changed.
Take screenshots showing the full address, date and time — including from a phone, if the redirect only targets mobile devices.
Export the access logs and statements from your payment provider before they're erased by rotation.
For strong evidentiary value before a judge, a judicial officer can draw up an official online report.
For your hosting provider, bank or insurer, a signed and dated report that can be verified by a third party speeds up the exchange: that's exactly what our Record analysis produces.

Before the next sales peak

Freeze all changes a few days before launch, keep a timestamped backup of the clean state, and have that state certified: the day something changes, you'll know what changed, and since when. That's the job of Watch monitoring, every night, for a full year.

The first 24 hours When your site opens another one When your host suspends the site All emergencies

Official and regulatory sources

How many files on your site can justify their presence?

You'll have the exact number, each file named, the likely date, and three signed documents that someone else can verify.

Analyse my site — €99 See pricing