Website Defaced or Down? First Response by Symptom
Site won't load, looks wrong, or triggers a browser warning — here's how to tell them apart and what to do first for each symptom.
Your website suddenly won't load, looks different than it should, or your browser throws up a warning — the cause and the right first move depend on which symptom you're seeing. Broadly, there are three patterns: (1) site won't load = likely a server or domain problem, (2) it looks wrong = possible defacement, and (3) a warning appears = possible malware or an expired certificate. The first step is working out which one applies to you.
Three symptom categories
- Site won't load (blank page, error message, can't connect) → likely a server or domain issue
- Appearance has changed (unfamiliar ads, strange text, unwanted redirects) → possible defacement
- Browser shows a warning ("dangerous site," "connection not secure," etc.) → possible malware or an expired SSL certificate
How to tell the symptoms apart
| Check | How to check | What it tells you |
|---|---|---|
| Is it just you? | Check from a different connection (e.g. mobile data) or a different computer | If it's only you, the problem may be on your end |
| Does no one see it? | Ask family or someone outside the company to check, or use an external uptime monitor | If nobody can see it, the problem is likely with the server or domain |
| Can you reach other sites? | Try loading a different site on the same network | If other sites also fail, the issue may be your connection or DNS |
| Is the URL correct? | Check the address bar | An unfamiliar redirect URL points to possible defacement |
| Is the certificate valid? | Click the padlock icon to view certificate details | An expired certificate is often the cause of browser warnings |
First response if defacement is suspected
- Don't rush to delete or edit files yourself — this destroys evidence needed to investigate the cause
- Take screenshots to document what happened and when
- If you're confident doing so, temporarily take the site offline or switch to a maintenance page; if you're not sure, leave it alone
- Contact your web developer or maintenance vendor promptly
- If your hosting control panel shows login history or file modification times, record them
Checklist when the site won't load
- Has the domain registration expired? (check your registrar's control panel or a Whois lookup)
- Is your hosting provider experiencing an outage? (check their status page)
- Has the SSL certificate expired?
- Has the service been suspended for a missed payment?
- Have DNS settings changed? (especially important if you recently migrated domains or hosting)
First response if a warning appears
If your browser shows a warning like "this site is not secure," possible causes include embedded malware, an expired SSL certificate, or a configuration issue. Start by checking the certificate's expiration date and request a renewal if it has lapsed. If malware is suspected, don't run a cleanup tool on your own judgment — consult your web developer or a security specialist. If your site has been flagged as "dangerous" by a search engine or security service, you'll need to fix the underlying cause and then submit a review request to that service before the warning is lifted.
When you can't reach your web developer
If you can't reach your contracted developer or maintenance vendor — or they've gone out of business — our guide on what to do when you can't reach your website developer covers the options in detail.
A note on WordPress sites
Sites built on WordPress are frequently defaced through exploited vulnerabilities in plugins or themes. Sites that haven't been kept up to date carry particularly high risk — see the maintenance risks of neglecting a WordPress site for more detail.
Preventing a recurrence
- Keep your CMS, plugins, and theme updated at all times
- Avoid reusing admin passwords, and enable two-factor authentication where possible
- Take regular backups and periodically verify that they actually restore correctly
- Track domain and hosting renewal dates on a calendar, and confirm auto-renewal is enabled
- Confirm the scope of your maintenance contract (updates, incident response, emergency contacts) with your developer in advance
Frequently asked questions
Should I report a defacement to the police?
If unauthorized access is suspected, you can consult your regional police cybercrime desk. Save screenshots and logs as evidence beforehand.
What should I do about inquiries while the site is down?
Consider directing visitors to an alternative contact method, such as a phone number or an existing social media account, while technical recovery proceeds in parallel with your developer or hosting provider.
Can I fix WordPress files myself?
Editing files before the cause is identified risks destroying evidence or making the damage worse. If you're not confident, it's best to consult your developer or a security specialist before touching anything.
If the domain expired, will renewing it fix things right away?
Renewal usually restores the site, but if you're past the grace period you may need to re-register the domain, and propagation can take some time. Check with your registrar or control panel.
Related free tools (no sign-up, instant results)
Feel free to contact us
Contact Us