# My business website is down or hacked: what do I do?

By Humfrid · Keeping it current · Published 2026-11-03 · https://humfrid.com/blog/website-down-or-hacked/

> First check whether your website is down for everyone or just for you. Then look for a lapsed domain or plan, the quickest thing to fix. Contact whoever runs the site, and tell customers on your Google Business Profile while it's down. If it was hacked, change your passwords, turn on two-step sign-in, and never pay a stranger who contacts you offering a fix. With Humfrid, you never log in to your website, and when something looks wrong, you text Humfrid what you see.

With Humfrid you never log in to your website, so there's no site password to keep track of. If something on it looks wrong, text Humfrid what you see, at the same number you send your changes to. Start at https://humfrid.com/.

Your website is where customers check your hours, see your work and find your number. When it's down, they hit a dead end. When it's hacked, Google may put [a warning label in search results or an interstitial warning page in the browser](https://support.google.com/webmasters/answer/9044101) in front of it. Much of the work below is finding who runs your site and getting into the right accounts; with Humfrid, that part is one text, to the same number you send your changes to. Take it in this order.

## Is my website down for everyone, or just for me?

Check this first; it takes two minutes. Open your site on your phone with Wi-Fi off, try a different browser, and ask a friend in another town to open it.

If it opens for them and not for you, the problem is probably your internet connection, your browser or your office network, not your website.

## Did my domain or my plan run out?

Your website rests on two things being paid: the domain (your web address) and the plan or hosting that keeps the site online. If either lapses, the site can stop. ICANN says that when a domain expires and its service is cut off, [any services associated with the domain name such as a website or email service](https://www.icann.org/resources/pages/registrant-about-errp-2018-12-07-en) stop working. So if your business email went quiet at the same time, a lapsed domain is the likely cause.

Search your inbox, including spam, for renewal notices. Registrars must send [at least two renewal reminder notices before the domain name expires](https://www.icann.org/resources/pages/registrant-about-errp-2018-12-07-en), about a month and a week ahead. Then sign in where you bought the domain and where the site is hosted, and look for an unpaid bill.

Renew right away. Even after an expired domain is deleted, ICANN's policy requires a [Redemption Grace Period of 30 days](https://www.icann.org/resources/pages/registrant-about-errp-2018-12-07-en) for generic endings such as .com, during which it can still be recovered.

## Who should I contact to get it back up?

Whoever runs your site: the website service or host you pay, or whoever set it up. Tell them what you see, when it started, and whether email stopped too.

If you think it was hacked, say so plainly. Google's help for hacked sites says to [tell your hoster that your site has been compromised](https://web.dev/articles/build-a-support-team), because they [can potentially help recover your site](https://web.dev/articles/build-a-support-team). If you don't know who hosts it, look for the monthly charge on your card statement. Our post on [who owns your website](/blog/do-i-own-my-website/) covers how to find out.

## How Humfrid does this for you

With Humfrid, you never log in to your website. There's no dashboard and no website password of yours to keep track of. Humfrid builds and updates your site by text, so when something looks wrong, that's who you tell. Text what you see, at the same number you send your changes to:

- "A customer says the site shows a warning."
- "There's a page on my site I didn't add."
- "My site won't open on my phone."

Your own .com web address is included and in your name, so you always know whose address it is.

Two accounts stay in your hands. You run your own Google Business Profile, which is where you tell customers if your site is ever down, and you run your own email. Give both a strong password and two-step sign-in today. Humfrid writes your Google posts and review replies for you to post.

If your site is with someone else and you've had enough, Humfrid builds you a new one from a few texts, live within a day once you OK it. You can keep the web address you have: Humfrid texts you three records to add where it's managed.

## What should I tell customers while it's down?

Tell them where to reach you, in the places they already look, and point them to your phone.

Post on your Google Business Profile. Google lets you post [updates, offers and events](https://support.google.com/business/answer/7342169), and [you can always edit a post](https://support.google.com/business/answer/7342169) once things are back. Something short works: "Our website is down for a day or two. Call or text us to book, same number as always." Humfrid writes a post like that for you to put up. Put the same note on your Facebook or Instagram page.

## How do I know if my website was hacked?

You may see pages or links you didn't add, or customers may say their browser warned them. Google lists common signs, including [suspicious new pages added to your site](https://web.dev/articles/faq-for-hacked-sites), [visitors reporting malware](https://web.dev/articles/faq-for-hacked-sites), and [newly created accounts with administrator privileges](https://web.dev/articles/faq-for-hacked-sites).

A quick check anyone can do: Google suggests typing site: followed by your web address into Google Search, which [shows you all the pages on your site, including pages a hacker might have added](https://web.dev/articles/how-do-i-know-if-my-site-was-hacked).

## What do I do if my website was hacked?

Work through these in order:

1. **Contact whoever runs your site** and tell them it was hacked. With Humfrid, that's a text. Ask what they'll fix and what they need from you.
2. **Change your passwords**, starting with any account that runs the website, then where your domain is registered, then your email. Google's advice is to [create a strong, difficult-to-guess password](https://web.dev/articles/top-ways-sites-get-hacked-by-spammers) and to [avoid reusing passwords across services](https://web.dev/articles/top-ways-sites-get-hacked-by-spammers).
3. **Turn on two-step sign-in** for each of those accounts. Google recommends [two-factor authentication](https://web.dev/articles/top-ways-sites-get-hacked-by-spammers), which asks for a code sent by text or made on your phone, as well as your password.
4. **Tell customers where to reach you**, and warn them not to click strange links on your site until it's fixed.
5. **Ask for Google's warnings to be removed once it's clean.** Google's [Help, I think I've been hacked](https://web.dev/articles/hacked) guide walks through recovery. In Search Console, Google's free tool for site owners, you [select Request Review](https://support.google.com/webmasters/answer/9044101) only after every listed issue is fixed.
6. **If your site collected customer information**, such as forms or orders, read the FTC's [Data Breach Response guide](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business). It notes that [all states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted legislation](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business) requiring notice of security breaches involving personal information, so check what applies to you.

## Should I pay someone who contacts me saying they can fix it?

No. If a stranger calls, emails or texts to say your site is hacked and offers a fix for a fee, treat it as a scam. The FTC warns that [legitimate tech companies won't contact you by phone, email, or text message](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams) to tell you there's a problem, and that scammers [often insist that you pay with gift cards, a wire transfer, a bank transfer, cryptocurrency, or a payment app](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams).

Never give a password or a card number to someone who reached out to you. If you need outside help, Google suggests you [seek help from a trusted security professional](https://web.dev/articles/faq-for-hacked-sites), one you found yourself.

## How do I make this less likely to happen again?

No one can make a website impossible to hack, but you can make the usual problems less likely. Keep the card on your domain and website plan current, and turn on auto-renew. Keep the contact email on your domain up to date; ICANN says to [make sure your contact information is up-to-date](https://www.icann.org/resources/pages/registrant-about-errp-2018-12-07-en) so the renewal notices reach you. Use a different strong password for each account, with two-step sign-in on all of them. Fewer logins means fewer to protect, which is one reason to let Humfrid run the site for you, with no website login of yours to keep.

Write down who runs your site and how to reach them. If you're switching providers after a bad experience, our post on [canceling a website and keeping your domain](/blog/cancel-website-keep-domain/) explains the order. Text Humfrid your business name, and you'll see your new website within a day.

## Sources

- [5 Things every Domain Name Registrant should know about ICANN's Expired Registration Recovery Policy (ERRP)](https://www.icann.org/resources/pages/registrant-about-errp-2018-12-07-en), ICANN
- [Create & manage posts on your Business Profile](https://support.google.com/business/answer/7342169), Google
- [Help, I think I've been hacked](https://web.dev/articles/hacked), Google
- [How do I know if my site was hacked?](https://web.dev/articles/how-do-i-know-if-my-site-was-hacked), Google
- [FAQ for hacked sites](https://web.dev/articles/faq-for-hacked-sites), Google
- [Build a support team](https://web.dev/articles/build-a-support-team), Google
- [Top ways sites get hacked by spammers](https://web.dev/articles/top-ways-sites-get-hacked-by-spammers), Google
- [Security issues report](https://support.google.com/webmasters/answer/9044101), Google
- [How To Spot, Avoid, and Report Tech Support Scams](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams), Federal Trade Commission
- [Data Breach Response: A Guide for Business](https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business), Federal Trade Commission