If you see unknown administrator accounts, spam pages, a browser warning or a host suspension, treat the site as a security incident. Write down what you saw, when it started and what changed recently. Do not delete files or overwrite evidence before you have a recovery plan.
Contain and get help
Contact the hosting provider through its official support route. Ask whether the account or shared server is affected, whether they can preserve a snapshot and what they recommend before taking the site offline. If customer data or payment systems may be involved, escalate to a qualified security and legal contact promptly.
WordPress.org’s hacked-site guide recommends documenting symptoms, checking with the host, scanning and reviewing every access point. Create a forensic copy even if it may be infected. Restore only from a backup you have reason to trust; a backup taken after the attacker entered may restore the same problem.
Clean, secure and verify
Have the cause identified and the malicious changes removed. Update WordPress, themes and plugins from trusted sources, remove anything unused or abandoned, rotate credentials after cleanup, invalidate active sessions and enable two-step verification. Check domain, DNS, hosting, CMS, email, database, repository and payment accounts. Test forms, orders, redirects and outgoing email before reopening the site; then review Search Console and any malware warnings.
JupiWeb’s care options start at €19 per month and list hosting, SSL, daily backups and security updates. A care plan is preventive maintenance, not incident response. Use the security check-up to review the controls after recovery.