A calm sequence beats heroic “quick fixes” that hide backdoors. For NZ SMEs, the goal is to get a trustworthy site back online without losing forensic detail your host or insurer may need.
First hour: contain and document
- Snapshot what you see: odd admin users, new files, unexpected redirects, or spam pages—screenshots and timestamps help.
- Do not delete blindly: wholesale deletes can destroy clues; prefer quarantine or restore.
- Alert your host: many compromises involve server-level issues only they can see.
Recovery paths: scan vs restore
Malware scans can clean some infections, but skilled attackers leave persistent shells. If you have a recent off-site backup from before the incident, a clean restore plus patch often beats weeks of whack-a-mole.
After recovery: rotate and tighten
Change all passwords, regenerate API keys, review two-factor coverage, and remove unused admin accounts. Re-check file permissions and disable abandoned plugins or themes that expand attack surface.
Frequently asked questions
Should I pay a ransom or “SEO recovery” cold caller?
Never grant server access to unverified callers. Use your host, a trusted partner, or law enforcement guidance for serious incidents.
Do I need to tell customers?
Depends on data affected and legal obligations. When personal information may be involved, get professional privacy/legal advice promptly.
Putting this into practice on your NZ website
This guide sits in our Security & maintenance collection. The goal is practical advice you can act on without a computer science degree. Start with one change, measure whether enquiries or usability improve, then tackle the next item. Small businesses across Auckland, Wellington, Hamilton, Christchurch, and regional New Zealand face the same constraints: limited time, real customers, and a website that must earn its keep.
For Incident response basics: first steps if your site is compromised, the highest-leverage move is usually to align your live site with what the guide recommends, then fix anything that blocks Google from crawling pages or stops visitors from contacting you. If your site runs on WordPress, many of these tasks are configuration and content work rather than custom development.
Document your starting point: note current enquiry volume, average page speed from PageSpeed Insights, and any errors showing in Google Search Console. Without a baseline, improvements are guesswork. Revisit the same metrics after 90 days—SEO and UX changes rarely produce overnight miracles, but sustained progress should be visible in leads and user behaviour.
Share this guide with whoever maintains your site—an employee, a contractor, or your hosting support desk—so terminology and priorities align. The FAQ section on our main site answers common project questions if you are weighing a rebuild versus incremental fixes.
When to involve a web partner
Some tasks—migrations, checkout changes, security incidents, or a full redesign—benefit from experienced help. If you are comparing providers, look for clear scoping, realistic timelines, and measurement tied to business outcomes rather than vanity metrics. Our team builds and maintains business websites nationwide; explore relevant services below or request a quote when you are ready.
A good partner will ask about your customers, geography, and capacity to publish content—not only colour preferences. Review our recent website projects for examples of brochure, WordPress, and ecommerce work across New Zealand.
Related NZDH services
More guides in this topic
- Website maintenance and security basics for NZ small businesses
- Suspicious files and permissions: what they can indicate
- Least-privilege credentials and break-glass access for owners
- Malware scans vs clean restores: picking the fastest recovery path
- Security headers beginners should know (high-level)
Browse the full Security & maintenance guide hub or return to the guides home.
Explore on NZDH.co.nz
- All practical guides
- Website design services
- SEO services
- Recent website projects
- Frequently asked questions
- Web hosting — NZ-friendly hosting with support that answers clearly
Authoritative further reading
These independent resources complement this guide. Search engines and customers both reward accurate, helpful information—we link out where official documentation or regulators explain the topic better than a generic blog post could.